Hello and welcome to this lecture in this lecture.
We will go through the last troubleshooting scenario and we will deal with a basic face to proposal
mismatch.
As you can see both of the tunnels are running now are up.
So both ICMP sessions are working and we will now go in for the gate user interface.
And obviously I'm connected on the HQ firewall and I will break again the configuration going to the
safe and let's say edit and now we will go to the phase to click on the pencil which means edit and
go to the advanced options.
And now where we change from shall want to MDG 5.
So click OK.
Now let's go to monitor and IP state monitor and let's say bring down.
Yes I'm sure.
So now it's down.
Let's try to bring it up.
It will not.
It will not go up after uh after this modification after this change.
So if you now take a look again you will see that the communication between the land P.C. in the headquarter
going to the branch SSA Cisco a firewall is not working.
So again obviously you have seen up to this point the debugging diagnosed messages are not so self-explanatory.
So now we'll talk about IP sec so IP said.
This is phase 2 and proposal mismatch.
So let's see exactly how the debug looks like maybe it's self-explanatory maybe it's not you tell me.
So now let's go and take the HQ 48 and let's say at mean and let's prepare the bugs.
So let's take this copy and let's run it
a lot.
A lot of the bugs I know I know it's true.
And now I will just stop it.
It's absolutely very very noisy as you can see.
And take it and stop.
Perfect.
So now let's navigate in the beginning.
Let's take the configuration.
Let's take the bugs and analyze it a lot a lot of the bugs.
I agree so still not there
or
well that's massive
and here it is so let's start and take everything that's here.
Actually not we will not take it.
We didn't take the previous debugger.
We will analyze it here and just put the conclusion.
So what's the end result of our analysis in.
In.
In the text.
Uh in the notepad in text editor that you're using you can do the same.
So where did it start.
Here.
Good.
So let's see.
Branch 1 and branch 2 branch 1 it's up it's running branch 2 is not.
So we're starting with branch 2 I can see.
So negotiation result proposal I.D. it's 1.
Let's go and see.
We should see the authentication working so appreciate key authentication succeeded because we have
it.
Uh yes.
We haven't done anything there.
So appreciate.
Care the locations of cities and authentication.
Okay.
Established ISO Phase 1 it's up operational up.
Now let's go on a branch 2.
So I basically say connect between this IP our IP and the NSA IP configuration found IP assay connect
good negotiating and let's see what the result of the negotiation for branch 2.
So sending the IP message quick i wont send I one exchange information and this is the I.D..
And here it is now this is something in what I called self-explanatory.
So for branch to notify.
Message received no proposal chosen.
Well that's a different story and no matching IP SEC SBI.
So we will take this and documented here
so.
Okay.
So now as you can see as I told you in the previous lecture.
So when we have an IP sic Phase 2 proposal mismatch This is a different story.
It is indeed self-explanatory.
Suddenly fire notify.
Message received no proposal chosen something something indeed different then for the essay proposals
that do not match for phase one.
So let's say here also phase phase 1 This is a different story.
So ignoring unsupported informational message while and the same for the pressure key mismatch ignoring
unencrypted payload more phone message from so the end of the tunnel the other end.
So anyway let's continue to look.
But this is the message.
So no proposal chosen.
So we don't have we don't have anything to match with what what I'm receiving.
And basically the the other end of the tunnel it's complaining the same.
Okay.
So I cannot establish a tunnel with you.
We cannot send encrypted traffic we cannot encrypt the traffic and protected because we are not using
the same phase two parameters.
So because because the IP SEC proposal was not matched no match no matching IP sic SBI now deleting
everything that's being configured.
And I believe this process repeats on and on and on.
So let's take a look.
Branch 2 again branch 2 negotiation result for Phase 1 let's continue continue continue we can see that
the vendor idea.
Cisco.
So we are trying to establish a site to site IP VPN with a Cisco equipment Cisco gear and let us continue
to look I care is a campus say this
and again.
So phase 1 has been successful.
What is it some branch to receive this.
OK.
So phase 1 has been successful.
Pure identifier please you get indications exceeded authentication.
Okay.
And now we should see again the failure for Phase 2 failure or Phase 2.
The IP SEC negotiation.
And here it is again.
So indeed the debug is absolutely noisy a lot of a lot of lines are inserted or are presented when we
have this problem notified.
Message received no proposal to them.
So perfect.
So this concludes the troubleshooting scenario and the course I hope you find it informative.
Hopefully it makes sense to you.
And thanks a lot.
Thank you for being here and I hope to see you in the upcoming courses as well.
Thank you.