Plumbing... QoS

Rule no 1. QoS does not help in situations where there is no enough bandwidth but helps optimize performance by prioritization of the traffic which helps to mitigate issues that occur periodically on the network.

Most common problems to solve:

1. Jitter: control the difference in delay between packets

2. Packet loss: Ensure that traffic capable of handling packet loss is dropped before traffic that cannot

3. TCP global synchronisation - refers to a network performance issue that can occur in congested or heavily loaded networks. It occurs when multiple TCP connections simultaneously reduce their sending rates due to congestion, resulting in periods of low network utilisation followed by sudden bursts of increased traffic

Main concepts:

1. Packet classification. Process of identifying different types of the network traffic based on its characteristic/flow (IP information, port, protocol, markings). 

  
2.  Traffic marking involves setting specific values (bits) in packet headers to indicate its priority following mechanisms can be used:

- at layer 3 by setting DSCP or IP precedence

- at layer 2 by setting CoS bits (Ethernet 802.1q defines three bits priority)

- when using MPLS by setting EXP bits

  
3.  Traffic classification can be also achieved with ACLs, NBAR (Network Based Application Recognition)

 
4. Congestion management/avoidance - RED and WRED two mechanisms to keep the traffic going by dropping randomly or per threshold traffic ahead of expected congestion. main difference between the two is that WRED provide more granular control over what is dropped. 

- marking is used to determine queue for each packet

- queues are used to make sure delay sensitive flows are not dropped i.e.: VoIP traffic is transmitted and not dropped.

- non-delay sensitive packets/lower priority queues may randomly drop traffic 

RED - Random Early Detection (treats all packets the equally)
       - avoids TCP global synchronisation streams, drops or marks packets randomly before queues are full

  
WRED - Weighted Random Early Detection (RED with more granular approach in terms of traffic classification, different queues and probability profiles)

5. Queuing or also called buffering uses two main mechanisms: LLQ and CBWFQ
    LLQ - Low Latency Queueing (extension of CBWFQ) adds strict-priority capability provides both bandwidth and latency guarantee. Recommended for real time traffic.
  both use to manage and schedule packets during congestion times.

    CBWFQ - Class-Based Weighted Fair Queuing - data traffic management only

6. Policing and shaping - both are traffic managment techniques used to enforce bandwidth limitation. Shaping rate/delay traffic to configured requirement. Policing monitors traffic and drops or remarks it if the configured limit is reached.

Traffic characteristics:

- Voice traffic:

  - smooth

  - benign

  - drop sensitive - less that 1%

  - delay sensitive - less 150ms one way delay / 30ms jitter

  - UDP

- voice/video conference traffic:

  - bursty and greedy:

    - dependent on codec and video quality

  - drop sensitive (less that 1%)

  - delay sensitive (150ms one way delay / 30ms jitter)

  - UDP

- Data traffic:

  - smooth or bursty

  - bening or greedy

  - drop insensitive

  - delay insensitive

  - TCP or UDP (TCP prevelent)

  

Traffic is often split into different traffic classes such us:

- premium (or platinium)

   - VoIP

   - Video conferencing

- gold

   - critical

- silver

  - Transactional

- Best Effort

   - Web traffic

   - email

   - etc...

OSPF area types and operations (JUNIPER - REVIEW)

OSPF area types allow networks to be segmented into smaller areas to reduce the amount of routing information that needs to be exchangedThe backbone area is the central area of the OSPF network and must exist in every OSPF network. Standard areas are connected to the backbone area and have their own LSDBs, while stub areas and NSSAs block external routing information to reduce the amount of routing information exchanged between areas. Totally stubby areas block both external and inter-area routes. Routers within the same area share the same LSDB and use it to calculate the shortest path to a destination network.

OSPF defines several types of areas, each with different functions and characteristics below are the OSPF area types and their operations:

Backbone Area (Area 0) - The backbone area (also called Area 0 - area id must be 0 / 0.0.0.0 in 32bit notation) is the central area of an OSPF network and it must exist in every OSPF multiarea network. All other areas must be connected to the backbone area directly, exeption her ei sthe use of Virtual-Link/tunnel. The backbone area is responsible for distributing routing information to other areas, and it forms the foundation of the entire OSPF network.

Standard Areas (Non-Backbone Areas) - Standard areas (also called non-backbone areas) are areas that are connected to the backbone area. Same as Backbone area Standard areas are identified by Area ID which must be different than 0 (or 0.0.0.0). Each standard area has its own link-state database (LSDB) that contains information about the network topology within that area. 

Stub Areas - Stub areas are standard areas that do not receive external routing information. External routing information is information about networks outside the OSPF domain. Stub areas are used to reduce the amount of routing information that needs to be exchanged between areas. Instead of receiving external routing information, stub areas use a default route to forward traffic to networks outside the OSPF domain. Stub areas can be configured as totally stubby areas, where no inter-area or external routes are allowed, or as not-so-stubby areas (NSSAs), which allow the injection of external routes but with some limitations.

Totally Stubby Areas - Totally stubby areas are a type of stub area that not only blocks external routes, but also inter-area routes. This means that routers within the totally stubby area only know about routes within their own area and the default route to reach networks outside the OSPF domain.

Not-So-Stubby Areas (NSSAs) - NSSAs are a type of stub area that allow the injection of external routes, but with some limitations. Unlike standard areas, NSSAs do not receive external routing information directly. Instead, an NSSA border router (ASBR) injects external routes into the NSSA as Type 7 LSAs, which are then translated into Type 5 LSAs by an NSSA Area Border Router (ABR) before being propagated into other areas.

BGP Lab topology for AS123 (part one 1)

 

> Topology Overview:

- Routers RG 31/32 - peering routers 

- Routers RR-10 / RR-20 - route reflectors

- Ps and PEs - core and customer connectivity

BGP CONCEPTS

> Pourpouse of BGP:

- interconnect between different AS (interdomain communication)

- widely used in Service Provider, Large Enterprise and Datacenter enviroments

- multihomed customers

- scalable 

- created with stability in mind

> Main considerations

- trust one one - eBGP filter advertisment in and out 

- policy based 

- multiprotocol support IPv4/6, VPNv4/6 and VXLAN

- reliable updates

- triggered updates only

- uses rich metrics/attributes

> Internal BGP

- neighbourship between two nodes in the same AS

- AS-PAth is not updated when sending to iBGP

- BGP Split-horizon is used to prevent the loops, iBGP updates are not forwarded to any other iBGP peer

- BGP next-hop is not changed

- used to carry partial of full table of internet routing prefixes

> External BGP

- neigborship between two nodes with different AS numbers

- when router receives a route with its own AS in the AS Path the information is discarded  (loop prevention)

- used to exchange prefixes with other ASes

- implements routing policies

> RFC 4456 / Route Reflectors

- removes the need for Full Mesh IBGP

- loop prevention is done using non-transitive attribute called CLUSTER_LIST and adding it is own ID to it

- when router receives update which CLUSTER_LIST contains router's own cluster ID the update is discarded.

- By default BGP Router ID value is used for cluster ID - has to be 32bit and can be changed i.e.: 0.0.0.1

- Multiple cluster IDs (MCID) feature allows to assign per-neighbor cluster IDs

> Possible scenarios of route reflection

- Between client and non-client

- Between clients in the same cluster (intra-cluster)

- Between clients in different clusters (inter-cluster)

Routing protocols - ISIS brief

What is IS-IS?

- it is a link state protocol which originates from ISO 10589 - Connectionless Network Protocol (CLNP)

- was originally designed to support CLNS, still uses CLNS for its transport

- supports both IPv4 and IPv6

- mostly popular in large ISP environments 

- similarly to OSPF it runs Dijkstra SPF algorithm

- use Hello packets to manage adjacencies (IIHs)

- use areas and two-level hierarchy, only two types of the areas 

- summarisation is only possible on ABRs between areas 

- elects designated router (DIS) similar to OSPF DR except no backup DR (backup DIS)

Sample lab diagram:

NOTE. It is essential to understand that the IS-IS connectivity between areas relays on the level-1-2 adjacencies. 

Concepts and Operations: 

- Router is an Intermediate System and host is End System

- SNPA - Subnetwork Point of Attachment - concept that relates to data link/data switch

- Frame is Data Link PDU / Packet is Network PDU

- LSP - Link State PDU - LSP is a packet itself

- two types of areas: Level 2 - backbone area and Level 1 - a non backbone area

- Level 1/2 routers (similar to OSPFs ABRs) must have databases for Level 1 and 2 areas 

- Virtual-Link not suported by many vendors, but it is possible to expand L1/2 adjacency  

- in general much simpler that OSPF

- supports two metric types: narrow(only IPv4) & wide (both IPv4 and IPv6 recommended)

Hierarchy:

Level 1 routing - routing within area

Level 2 routing - routing between areas - backbone 

Design concepts for IS-IS:

- good addressing schema to summerize on ABRs

- need to plan CLNP addressing (NET)

- two layer hierarchy to limit LSP flooding and point of subnet summarization

- need to use wide metrics

- all interfaces by default are cost of 10

- cost needs to be set manually (plan cost per link speed then assign)

- allows up to 1000 routers per area - great for scalability

DevNet notes - Linux - Bash (2)

grep basics

grep is a command line tool for searching plain text to match a regular expression

grep use examples:

#grep 'import' test_requests.py - will display line in the file that contains word 'import'

output:

    from turtle import title

    import requests

    from bs4 import BeautifulSoup

#grep -R 'import' . - will look for all files within the directory and subdirectories that contain word 'import'

output:

    ./test_urllib:import urllib3

    ./xml2-to-dict.py:import xmltodict

    ./xml-to-dict.py:import xmltodict

    ./eveng-request.py:import requests

    ./parse_yaml.py:import yaml

    ./test_requests.py:from turtle import title

    ./test_requests.py:import requests

    ./test_requests.py:from bs4 import BeautifulSoup

    ./automate-l1.py:from __future__ import print_function, unicode_literals

    ./automate-l1.py:import logging

    ./automate-l1.py:from netmiko import ConnectHandler, redispatch

    ./automate-l1.py:from netmiko import Netmiko

    ./automate-l1.py:from getpass import getpass

    ./json-test.py:import json

    ./parse_json.py:import json

other options:

'-i' - will make above search case sensitive, example:

#grep -R -i 'Cisco123' .

output:

    ./curl_get_token.sh:curl -X POST -u 'devnetuser:Cisco123!' -H 'Content-Type: application/json' https://sandboxdnac.cisco.com/dna/system/api/v1/auth/token

'-G' -indicates a standard regular expression, supports following metachracters:

     ^ beggining of the line

     $ end of the line

     . single character

     * zero or more occurences of the preceeding character

     [xyz] to match either 'x', 'y' or 'z'

     [d-f] or [1-3] to match character in the range between 'd-f' or '1-3'

     \< or \b to match beggining of the word

     \> to match end of the word

     \ escape character

     

'-E' -indicates extended regular expression, supports all above metacharacters used in standard expression and additionally:

     ? zero or one occurance of the proceeding character

     + one or more occurancess of the proceeding character

     {X} or {X,Y} strings with X repetition or X repetition but lower that Y repetition

     | operator 'OR'

     () capture group

'-F' -indicates fixed regular expression

'-P' -indicates Perl regular expression

Bash - echo command

echo " Hello! " - outputs the text inside quatation marks, also supports following escape characters:

    \n -new line

    \t -horizontal tab

    \v -vertical tab

    \b -backspace

    \\ -prints the backslash

echo - how to show variable/run command within quotation marks? use '$' sign, example:

lets set a variable:

#MY_VAR='0123456789'

use case:

#echo "my test variable is: $MY_VAR" 

output:

    my test variable is: 0123456789

another use example:

#echo "list of my files: $(ls)" - will return list of files in the current location

YANG Data Model (notes - part 1)

- YANG is defined in RFC 6020 

- defines hierarhy of data, structures data models in to modules and submodules

- used to model data for NETCONF

- permits the definition of reusable groupings of nodes

- RFC 6021 - describes common YANG types used in networking 

   these can be imported with import statment:

   

   import "ietf-yang-types" {

      prefix-yang;

   }

   - then as a reference when accessing definitions use "yang" as a prefix i.e.:

    type yang:port-number    

- Four types of nodes are used for data modeling:

   a) Leaf node(s) - smallest component, one value i.e. ipv4 address 

   b) Leaf-list - a sequence of leaf nodes with exactly one value of a

   particular type per leaf

   c) Container nodes - group related nodes in a subtree

   d) List nodes - defines a sequence of list entries

- examples of build-in YANG data types:

   a) binary

   b) bits

   c) boolean

   d) decimal64

   e) int8/16/32/64

   f) uint8/16/32/64

   g) empty

   h) string

- Derived Types (typedef)

   "typedef" statment can be used to define derived types, example:

     

       typedef listen-port {

         type uint16 {

         range "65520 .. 65530";

     }

     description "open ports for testing"

     }

   

   Derived type statments:

   a) default

   b) description

   c) status

   d) reference

   e) type

   f) units

- augment - is to add new schema nodes to a previously defined schema node

DevNet - Linux - Bash (1)

 BASH basics

- acronym for "Bourne Again Shell"

- allows for command and script processing

- supports piping i.e.:

$env | more 

will add page breaks when displaying the information:

- For help  "man" can be used to access detailed information about command i.e.:

$man pwd

will return:

- sample commands:

pwd - print current working directory

ls - list files and directories, optionally can be used with "-a" (show all including hidden files) or "-l" to list permissions and user/group ownership, example:

mkdir - create directory

rm - deletes file or directory, useful flag "-rf" to force remove all files within deleted

        folder

cp - copy file or folder, does not delete the source file

mv - move file/folder between directories, also can be used to rename files/folders

        using "mv -f " will force overwrite if destination file already exists

cat - can be used to view or create files, 

        useful example $cat filename.txt | more 

touch - used to create an empty file or change the time stamp without opening it

- running commands at the admin level "sudo" can be used, example:

  $sudo apt-get update - this will prompt user to enter password before proceeding with an update of the list of available packages

- environment variables:

env - to view current set of variables, example: $env | more

echo - can be used to display single variable i.e.: echo $PATH

export - can be used to add new variable i.e.: export PASS=c1sco

unset - can be used to remove variable i.e.: unset PASS

note! newly created variable will be lost after session reload unless it is added to .bashrc file (or .zshrc on MacOS) 

to add variable, example:

$echo "export PASS=c1sco" >> .bashrc

to reload the variables:

$source ~/.bashrc or $. ~/.bashrc 

DevNet - Python module Urllib3 - user-friendly HTTP client

 Urllib3 is a HTTP client for python it can grab data, post data, stream data, work with JSON as well as use redirects.

Urllib3 can be installed using pip:

    python -m pip install urllib3

    or via GitHub:

    git clone git://github.com/urllib3/urllib3.git

    python setup.py install

code example:

 cat test_urllib 

#!/usr/bin/env python3

"""urllib3 module test"""

import urllib3

http = urllib3.PoolManager()

URL = 'http://dub-ne.blogspot.com'

resp = http.request('GET', URL)

print(resp.status)

- this example create GET request to www.dub-ne.blogspot.com and prints the return code of response, output:

 

python test_urllib 

200

- code 200 ("OK") indicates that the request has succeeded.

HTTP response code groups:

• Informational responses (100–199)
• Successful responses (200–299)
• Redirects (300–399)
• Client errors (400–499)
• Server errors (500–599)

Urllib3 features:

• Thread safety.
• Connection pooling.
• Client-side SSL/TLS verification.
• File uploads with multipart encoding.
• Helpers for retrying requests and dealing with HTTP redirects.
• Support for gzip, deflate, and brotli encoding.
• Proxy support for HTTP and SOCKS.
• 100% test coverage.

Documentation: urllib3.readthedocs.io

DevNet - Parsing data formats in Pyton: JSON & YAML (basics)

JSON data code example.

- JSON file:

{ "node": 

  { "hostname": "Edge1", "details": { "interface":

   { "name": "Ethernet0", "description": "L2 Uplink", "enabled": "true"

   }

                                    }

  }

  }

- Python file:

#!/usr/bin/env python

""" simple code to parse json """

import json

with open("data.json", "r", encoding = "UTF-8") as file:

    data = json.load(file)

    print(data)

- Output: 

python parse_json.py

{'node': {'hostname': 'Edge1', 'details': {'interface': {'name': 'Ethernet0', 'description': 'L2 Uplink', 'enabled': ‘true'}}}}

*** of course we can narrow the output information by modifying print command to for instance:

print(data['node']['hostname'])

which would return only the hostname:

python parse_json.py

Edge1

*** there are four ways to be used when parsing data:

    - load() - import native JSON as Python dictionary 

    - loads() - import JSON data from the string

    - dump() - used to write JSON data from python objects into JSON file

    - dumps() - same as dump() except returns string, does not require file object

YAML example:

- YAML file:

cat data.yaml  

---

device:

    hostname: Edge1

    interface:

        name:Ethernet0

        description:Uplink

        enabled:true

...

- Python file:

cat parse_yaml.py 

""" parse YAML file simple example """

import yaml

with open ("data.yaml", "r", encoding = "UTF-8") as fdata:

    ydata = yaml.safe_load(fdata)

    print(ydata)

- Output

python parse_yaml.py

{'device': {'hostname': 'Edge1', 'interface': 'name:Ethernet0 description:Uplink enabled:true’}}

*** two functions are available with in YAML module:

   - yaml.load - to convert YAML data into Python

   - yaml.dump - to convert Python data back to YAML

-----

All files are available on my GitHub: https://github.com/lightarchivist/DevNetLabs

DevNet - XML - Parsing Data Formats in Python

 We should think of data formats in terms of different ways of providing structure and consistency to present the data.

->XML - Python natively supports XML encoding and decoding. Parsing XML data is not straight forward way when compared to YAML and JSON.

The simplest way is to parse the XML file is to convert it to ordered dictionary using xmltodict module. Ordered dictionary is a subclass of dictionary in Python and it is used because it remembers the order of how the keys are inserted in to dictionary.

Example:

XML file:

<?xml version="1.0"?>

<device>

 <hostname>Edge1</hostname>

 <interface>

  <name>Ethernet0</name>

  <description>L2 Uplink</description>

  <enabled>true</enabled>

 </interface>

</device>

Install xmltodict module: pip install xmltodict

Python file:

import xmltodict

xmlFile = open ('lab.xml')

xmlData = xmlFile.read()

xmlFile.close()

xml_dict = xmltodict.parse(xmlData)

print(xml_dict)

Output after running Python script:

OrderedDict([('device', OrderedDict([('hostname', 'Edge1'), ('interface', OrderedDict([('name', 'Ethernet0'), ('description', 'L2 Uplink'), ('enabled', 'true')]))]))])

Additional info: link to tutorial how to use xml.etree.ElementTree module:

https://docs.python.org/3.8/library/xml.etree.elementtree.html

All examples are available on my GitHub: https://github.com/lightarchivist/DevNetLabs

DevNet - data formats [XML, JSON, YAML]

-> XML - Extensible Markup Language - platform neutral and data format. It has a tree like structure starting with a root element at the top and a parent/child relationship between elements. In below example device is the root element. First line in XML file is called prologue and it includes version and encoding information. Tags are used defined and usually documented by API provider. 

XML can be problematic to parse in Python due to the fact that the order of data is important Python module: xmltodict converts XML into ordered dictionary.

Example:

<?xml version="1.0" encoding=“UTF-8"?>
<!— example of comment in XML —>
<device>
<hostname>Edge1<hostname/>
<interface>
<name>Ethernet0</name>
<description>L2 Uplink</description>
<enabled>true</enabled>
</interface>
</device>

Keep in mind: in XML whitespace is insignificant

-> JSON - JavaScript Object Notation - data structure that comes from Java programming language but it is not limited to it and can be used independently. Data objects in JSON are comma separated key/value pairs which can be nested to create hierarchy/structure of data model. following are examples of supported data types: Strings, numbers, booleans or nulls.

Example:

{ "node":

  { "hostname": "Edge1", "details": { "interface":

   { "name": "Ethernet0", "description": "L2 Uplink", "enabled": "true"

   }

                                    }

  }

  }

Keep in mind: JSON does not support comments unlike XML or YAML, whitespace is insignificant and used to help with human readability.

-> YAML - YAML Ain’t Markup Language - human friendly data format that can be used with all programming language. Syntax is very minimal, YAML file opens with three dashes (“—-”) and close with three dots (“…”), hash and a space (“# ”) indicates comment. 

Example:

---

device:

    hostname: Edge1

    interface:

        name:Ethernet0

        description:Uplink

        enabled:true

...

To work with YAML 

Keep in mind: YAML parsers can parse JSON as well. White space is significant, indentation with a use of space (not Tab) indicates hierarchy and it should be consistent.

Automation is simple - Netmiko is great

While back in the galaxy far away I was asked to write a script to pull the data from all the remote nodes.  As I was unable to use Ansible as it would not work after quick research I realized Netmiko was the answer. I found Kirk Byers GitHub here: https://github.com/ktbyers/netmiko/tree/develop/netmiko and modify one of his examples for my own purpose.

The differences from the original script by Kirk Byers is that I am using loop and store password so I don't need to enter it every time script logs to another device as well as I am collecting logs for troubleshooting purposes. Initially I use the script to pool licensing data but as it usually happens the script due to its simplicity was used for other tasks.

Below is the modified version of the script that can be used to change/add local used on Huawei nodes and verify if the user account is working. Beside a script itself there are two other text files required one with list of all nodes and the second with the list of commands to be executed (which i am not going to publish here). Third file "verification" is run for verification purposes

Script:

#!/usr/bin/env python

from __future__ import print_function, unicode_literals

# this script adds new local user for all devices included ipListOfNodes file

import logging

# Netmiko is the same as ConnectHandler

from netmiko import ConnectHandler, redispatch

from netmiko import Netmiko

from getpass import getpass

# logging for troubleshooting purposes

logging.basicConfig(filename='test.log', level=logging.DEBUG)

logger = logging.getLogger("netmiko")

hostFile = open ('ipListOfNodes','r')

hostList = hostFile.readlines()

hostFile.close()

# admin password

mypass = getpass()

# new password for the new local user

adpass = getpass()

# adjust aaa settings and save

for device in hostList:

    huawei = {

        "host": device,

        "username": "username",

        "password": mypass,

        "device_type": "huawei",

                }

    net_connect = Netmiko(**huawei)

    output = net_connect.send_config_from_file("change_file.txt")

    print(output)

    net_connect.disconnect()

# verify admin user and pwd

for device in hostList:

    huawei = {

        "host": device,

        "username": "admin",

        "password": adpass,

        "device_type": "huawei",

                }

    net_connect = Netmiko(**huawei)

    output = net_connect.send_config_from_file("verification")

    print(output)

    net_connect.disconnect()

Script require user who is making a change to type his password and new user password at the very beginning.

Logs to all devices make a change then logs again to all devices with new user name and credentials and can run commands from verification file.

 

For troubleshooting purposes script sends logs to test.log file. 

More scrips will be available here: https://github.com/lightarchivist/DevNetLabs

Lab topology

 I am currently preparing for Cisco 300-715 SISE exam. I thought I will share my lab diagram and I will follow with some configuration examples in my next posts starting with configuration of access layer switch {NAD}. There few more elements that I am planning to add but this will happen in the future.

Lab overview:

- Dell T1700 (quad core Xeon + 16GB RAM) running VMware ESXi

- Cisco ASA 5505 (also have Cisco ASA 5520) later on I will connect other physical devices to it for instance physical switches,WLC an AP

 

I should add, just for SISE exam this topology is a bit of an over kill, but it comes handy with every day work.

UPDATE: Passed Cisco SISE 300-715 exam!

FlexVPN - Site-to-Site (1)

IKEv2

 

Few words on IKEv2:

-    described in RFC 7296 (initially RFC 5996)
-    offers dynamic key exchange and peer authentication
-    addresses measures to fix vulnerabilities of IKEv1 (anti-DoS)
-    supports Extensible Authentication Protocol (EAP)
-    it is not backward compatible with IKEv1
-    operates in two phases
-    industry standard, can operate in multivendor environment

IKEv2 operation:

-    Phase 1 is IKE_SA it consist a message pair IKE_SA_INIT (key exchange policy)
-    Phase 2 is CHILD_SA, first message pair is IKE_AUTH, additional CHILD_SA can be sent for rekey and information messages (data policy) 

R1 is the Initiator / R2 is the Responder

SA – security association
KE – Key exchange
Nr,Ni – Nonce
Cert-Req – Certificate Request
Cert – Certificate
IDi – Identification (Initiator/Responder)
TSi – Traffic selector – Initiator
TSr – traffic selector – Responder

 
IKEv2 authentication methods:
-    pre-shared keys (PSK)
-    digital signatures
-    EAP

IPSec 

IPSec consist of two main security protocols:
- Authentication Header (AH- IP protocol ID  51) – used for authentication and Integrity, enforces anti replay protection (receiving host sets replay bit in the header). AH is applied to datagram only.
- Encapsulation Security Payload (ESP- IP protocol ID 50) – used to provide confidentiality (encryption), data origin authentication, integrity, optional anti-replay service. Performs encryption at the IP packet layer, support symmetric algorithms by default 56-bit DES.

The AH can be applied alone or together with the ESP.

IPSec supports following standards:
-    Data encryption standard (DES), Triple DES (3 DES)
-    Delffie – Hellman (D-H)
-    Message Digest 5 (MD5)
-    Rivest, Shamir, and Adelman (RSA) signatures
-    IKEv1/v2
-    Certificate Authorities

IPSec operates in two modes:
-    Tunnel mode – A new IP header is created in place of the original this allow for encryption of entire original packet. Tunnel mode is used to encrypt traffic between secure IPSec Gateways i.e. Site to Site VPN or Cisco VPN Client and a IPSec Gateway.
-    Transport mode – The AH or ESP is inserted behind the IP header, the IP header can be authenticated but not encrypted. Use example would be an encrypted Telnet or Remote Desktop session from a workstation to a server.
In transport mode IP header is exposed.


Smart Defaults – this feature minimize FlexVPN configuration process. For example is following configuration steps can be skipped:
-    IKEv2 Proposal
-    IKEv2 Policy
-    IPSec transform-set
-    IPSec profile

default values will be picked, to verify default values:
-    sh crypto ikev2 proposal
-    sh crypto ikev2 policy
-    sh crypto ipsec transform
-    sh crypto ipsec profile

The think to remember is to use “default” as a name for the ikev2 profile.

LAB. Site to site FlexVPN with SVTI (using smart defaults)

 

 

RTR-01

crypto ikev2 keyring FlexVPN

 peer rtr-02

  address 20.0.0.1

  pre-shared-key local cisco

  pre-shared-key remote cisco

 

crypto ikev2 profile default

 description --->Basic FlexVPN<---

 match identity remote address 0.0.0.0

 authentication remote pre-share

 authentication local pre-share

 keyring local FlexVPN

 

crypto ikev2 dpd 10 3 on-demand

 

interface Tunnel200

 description FlexVPN-to-rtr-02

 ip address 10.120.0.1 255.255.255.252

 tunnel source Ethernet1/1

 tunnel mode ipsec ipv4

 tunnel destination 20.0.0.1

 tunnel protection ipsec profile default

 

RTR-02

crypto ikev2 keyring FlexVPN

 peer rtr-01

  address 10.0.0.1

  pre-shared-key local cisco

  pre-shared-key remote cisco

 

crypto ikev2 profile default

 description --->Basic FlexVPN<---

 match identity remote address 0.0.0.0

 authentication remote pre-share

 authentication local pre-share

 keyring local FlexVPN

 

crypto ikev2 dpd 10 3 on-demand

 

interface Tunnel200

 description FlexVPN-to-rtr-01

 ip address 10.120.0.2 255.255.255.252

 tunnel source Ethernet1/0

 tunnel mode ipsec ipv4

 tunnel destination 10.0.0.1

 tunnel protection ipsec profile default

Verification:

RTR-01-HUB#show crypto ikev2 sa detailed
 IPv4 Crypto IKEv2  SA

Tunnel-id Local                 Remote                fvrf/ivrf            Status
1         10.0.0.1/500          20.0.0.1/500          none/none            READY
      Encr: AES-CBC, keysize: 256, Hash: SHA512, DH Grp:5, Auth sign: PSK, Auth verify: PSK
      Life/Active Time: 86400/248 sec
      CE id: 1001, Session-id: 1
      Status Description: Negotiation done
      Local spi: 6445B887B3DC849B       Remote spi: CB227544A6FD4612
      Local id: 10.0.0.1
      Remote id: 20.0.0.1
      Local req msg id:  2              Remote req msg id:  0
      Local next msg id: 2              Remote next msg id: 0
      Local req queued:  2              Remote req queued:  0
      Local window:      5              Remote window:      5
      DPD configured for 10 seconds, retry 3
      NAT-T is not detected
      Cisco Trust Security SGT is disabled
      Initiator of SA : Yes

 IPv6 Crypto IKEv2  SA

RTR-01-HUB

RTR-02#show crypto ikev2 sa detailed
 IPv4 Crypto IKEv2  SA

Tunnel-id Local                 Remote                fvrf/ivrf            Status
2         20.0.0.1/500          10.0.0.1/500          none/none            READY
      Encr: AES-CBC, keysize: 256, Hash: SHA512, DH Grp:5, Auth sign: PSK, Auth verify: PSK
      Life/Active Time: 86400/159 sec
      CE id: 1001, Session-id: 1
      Status Description: Negotiation done
      Local spi: CB227544A6FD4612       Remote spi: 6445B887B3DC849B
      Local id: 20.0.0.1
      Remote id: 10.0.0.1
      Local req msg id:  0              Remote req msg id:  2
      Local next msg id: 0              Remote next msg id: 2
      Local req queued:  0              Remote req queued:  2
      Local window:      5              Remote window:      5
      DPD configured for 10 seconds, retry 3
      NAT-T is not detected
      Cisco Trust Security SGT is disabled
      Initiator of SA : No

 IPv6 Crypto IKEv2  SA
 

Wireshark capture of the test ping from rtr-01 to rtr-02.