Hello and welcome to this lecture in this lecture.
We start troubleshooting scenarios and specifically in this one we'll talk about the pressure key mismatch.
Now first of all you should know that the debunkers are not self explanatory for most of the vendors
so it's not like you will find in the log or in the diagnose as you will see here in in 48 fire all
that.
I don't know appreciate a key mismatch or I don't know.
Let's say encryption is not the same on both on both equipment's configured to say so.
So it is absolutely critical that you know exactly how the debug looks when the configuration is functional
so that in case the debug is not self-explanatory you can just find quickly that something is missing
or maybe something is not behaving like you know it should.
When when the when the network is functioning correctly.
So in this in this scenario because we have two tunnels configured on the HQ 48 we will miss configure
or break the configuration between the NSA and the HQ for the gate.
And this way we will see how the debug looks.
But at the same time because we have a VPN a VPN tunnel between the two for the gate firewalls we will
also see how the holiday bug should look when things do work correctly.
So what we'll do now.
Let's go on VPC is one.
So at this moment the the tunnel is working.
I am no pinging from from the HQ from the from the test B.C. on the HQ side.
I am pinging the NSA and I will start also upping let's say from from the branch once or from the 40
gate fire or branch toll words let's say two words one the one hundred minus C and a lot of packets
so that we see exactly how how they behave and how the how bugs.
How did the bugs look.
So at this moment both of the both of the tunnels are up and we can see these by going in the user interface
graphical user interface.
I don't know I'll now log in later later and I will look in the VPN in the IP SEC tunnels as you can
see the status for both of them it's up now because in this scenario we want to test the pressure key
mismatch.
I will have now to bring the configuration for branch 2 and I will say edit and let's go to authentication
appreciate key and instead of 14 and I will do something like this.
So let's say that there is a typo there and you just typed fast and you didn't see it anyway.
So now we have to troubleshoot the error and say OK now going to the monitor and going to IP sic monitor
I'm seeing that the first tunnel to the 40 gate in branch one is up and 4 4 branch 2 for Cisco I say
we have a tunnel down so let's check.
Also VPC is one.
So now I am trying to ping the NSA.
I see that the ping is not successful.
And for the second one I see that the ping is successful.
So let me just arrange that to a little bit like this
okay.
And now let's go in the NSA sorry in the in the HQ so in the HQ 48 and I will start some debugging.
So the debugging is in this case to diagnose.
So let's say this one is not important.
You can just filter the box so that you you outline only the the tunnel that you want.
But I don't want any filter.
I want to see everything that's happening there.
The having their in in terms of the process.
So what's the first command.
I just thought the debugging for AI application I would just enable them the diagnosing debug and I
would restart the whole AI process so that I can see the negotiation from the beginning to the end or
at least from the beginning till the moment it breaks.
Now after you start the debate you will see that more and more messages will come.
So you will not you will be you will not be able to to read or to analyze the logs.
So it is better to stop the debugging and you can say this way you can do this.
We diagnose the bug reset and diagnose the bug NDA.
So now that we have the command prepared let's go on and put them here in the CLIA of the 48 the HQ
48.
So I'll leave some space here and I will now just run the comments so a lot of commands a lot of commands.
Now I will stop it so that I can copy all of the debug that resulted here and analyze it in a notepad.
It is a good idea because you can see it you can see it better.
You can be sure that nothing will change and no logs will appear.
Although we have we have stopped it anyway.
Let's analyze it here and we will copy paste in there just for reference and so let's start from the
beginning so from here.
And let's see now so you can see here that you have branch one and branch two so branch one refers to
the the tunnel that is working going to the other for the gate and branch two is going to the Cisco
essay.
So let's go now through the logs and see the differences between the two remember I have changed appreciate
key on the on the tile going to the Sisko essay.
So now we are looking here at the debugger for branch 1.
So this one is working let's see what's the information presented.
So negotiation result proposal I.D. number one protocol Ida Isaac cam.
So we have.
Does and Emily five let's see what's next.
Pressured key lifetime let's continue to look for the logs and let's say branch one branch 1 branch
1.
Here it is.
So this is something that you will not see for branch 2.
So peer identifier.
This is the I.P. address configured again.
Let's take a look.
Nineteen ninety ninety.
So configure on the branch 48.
Let's come back to the HQ 48 and you see here.
So pure identifies this as a case of Bishop key authentication succeeded and authentication is OK.
So after after after establishing the essay we see that there has been negotiation.
And here is the result.
We have been prevented.
But we have been presenting this here.
So negotiation result proposal idea is this.
Then you see that the authentication has succeeded.
So authentication succeeded.
And authentication is OK established I say so security association with this with this I.D..
Now we move on to branch to let's see what's the message for branch to so branch 2.
So negotiation result proposal is this is again is this.
Nothing changed until this until this step.
So let's see what happens now.
So coming from coming from this IP.
This is the NSA on UDP port five hundred coming to my IP and port is the same five hundred.
This is the classic negotiation.
Let's see next what's happening.
Let's go.
More and this is it.
So on branch to tunnel negotiation immediately after saying that OK this is the proposal I'm using it
says ignoring unencrypted payload mail phone message from.
And this is the NSA IP.
So basically this is the message that that highlights the appreciate key authentication mismatch.
And if we continue to look we will see that there has been some retransmission again for branch 2.
So it's trying again and again and again to renegotiate and let's see that it's going to happen again.
So sending a message of retransmission between us and the NSA again retransmission resent last message
let's continue.
We transmit and that's it.
So again for any pressure key authentication mismatch between the 48 and and the other peer you would
see a message.
Again I would look for it to to highlight to highlight the message and is this so ignoring unencrypted
payload malformed message from this and I will now paste it here just that we have it for our reference
for Pete appreciate.
Key mismatch so mismatch.
This is what we have seen.
So this is it.
So again now let's uh let's fix it so let's have it working.
Now again at mean and later and later we will go to VPN and IP sic tunnels for branch to edit and for
authentication I will now type it correctly.
So it's 14 that I would say this and this and now we should see that the VPN should come up.
So let's see if this happens or not.
So that one hundred yes this is it and we should see the IP SEC tunnel in the upstate.
And here it is.
Now if I go again on the age of 48 just to have it to see it working here as well I'll now start again.
The diagnosis debug and here it is and now I will stop it.
So let's look now for branch 2 and see the same that authentication has succeeded.
So again because the bugs are not self-explanatory we should get used to what's the oral or what's the
debugger how should the debug look like when things work so that when they do not work correctly we
can easily spot the difference and pinpoint the exact problem.
So let's see for branch to
branch 2.
Here it is.
So for branch 2 We have pure identifier.
This is the IP of the essay pressured guilt indication succeeded and authentication.
It's okay.
This is the log saying that okay.
The ISAF the Security Association has been established and this is the.
This is the I.D..
So this is all for this lecture.
Thanks a lot and see you in the upcoming lecture where we study the next debug and specifically we are
going to break this time.
The Phase 1.
So we will modify other are the other SHA 1 so encryption authentication and we'll see how the debug
looks.
Again thanks a lot.