50 ESP Encap Security Payload Y [RFC4303]
Step 1. Load initial configurations. (see below)
Step 2. Turn off console logging on R1 because you are using the log keyword in your acl and you'll be getting a lot of hits. Use the show logging | include ACCESS to look at your hits.
(Remember ip access-list log-update threshold 1 guys.)
Step 3. remove tunnel protection on R3.
Step 4. Clear access-list counters and logging buffer on R1.
Step 5. apply tunnel-protection on R3.
Step 6. Sit back and enjoy the show.
Show your access-list and logging buffer.
initial configs
======== R1 ============
R1#sho run
Building configuration...
Current configuration : 2533 bytes
!
! Last configuration change at 22:34:25 UTC Fri Mar 30 2018
upgrade fpd auto
version 15.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
aqm-register-fnf
!
no logging console
!
no aaa new-model
no ip icmp rate-limit unreachable
!
!
!
!
!
!
no ip domain lookup
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
redundancy
!
!
ip tcp synwait-time 5
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco address 23.1.1.3
!
!
crypto ipsec transform-set IPSEC-TRANSFORM-SET esp-aes esp-sha-hmac
mode tunnel
!
crypto ipsec profile IPSEC-PROFILE
set transform-set IPSEC-TRANSFORM-SET
!
!
!
!
!
!
!
!
interface Loopback0
ip address 1.1.1.1 255.255.255.255
!
interface Tunnel1
ip address 13.1.1.1 255.255.255.0
tunnel source 12.1.1.1
tunnel destination 23.1.1.3
tunnel protection ipsec profile IPSEC-PROFILE
!
interface FastEthernet0/0
no ip address
shutdown
duplex half
!
interface Serial1/0
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/2
ip address 12.1.1.1 255.255.255.0
ip access-group PACKET-COUNTER in
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
router ospf 1
network 1.1.1.1 0.0.0.0 area 0
network 12.1.1.1 0.0.0.0 area 0
!
router bgp 100
bgp log-neighbor-changes
neighbor 13.1.1.3 remote-as 300
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
ip access-list extended PACKET-COUNTER
permit gre host 23.1.1.3 host 12.1.1.1
permit ospf any any
permit tcp any eq bgp any
permit tcp any any eq bgp
permit icmp host 23.1.1.3 host 12.1.1.1 port-unreachable
permit icmp any any 0 0 log
permit icmp any any log
permit ahp any any log
permit esp any any log
permit pcp any any log
permit udp any any eq isakmp log
permit ip any any log
!
ip access-list log-update threshold 1
no cdp log mismatch duplex
!
!
!
control-plane
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
gatekeeper
shutdown
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line vty 0 4
login
transport input all
!
!
end
R1#
R1#
R1#
R1#
======== R2 ============
R2#sho run
Building configuration...
Current configuration : 1518 bytes
!
! Last configuration change at 20:48:23 UTC Fri Mar 30 2018
upgrade fpd auto
version 15.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
aqm-register-fnf
!
!
no aaa new-model
no ip icmp rate-limit unreachable
!
!
!
!
!
!
no ip domain lookup
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
redundancy
!
!
ip tcp synwait-time 5
!
!
!
!
!
!
!
!
!
!
interface Loopback0
ip address 2.2.2.2 255.255.255.255
!
interface FastEthernet0/0
no ip address
shutdown
duplex half
!
interface Serial1/0
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/1
ip address 12.1.1.2 255.255.255.0
serial restart-delay 0
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/3
ip address 23.1.1.2 255.255.255.0
serial restart-delay 0
!
router ospf 1
network 0.0.0.0 255.255.255.255 area 0
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
no cdp log mismatch duplex
!
!
!
control-plane
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
gatekeeper
shutdown
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line vty 0 4
login
transport input all
!
!
end
R2#
======== R3 ============
R3#sho run
Building configuration...
Current configuration : 2044 bytes
!
! Last configuration change at 23:52:44 UTC Fri Mar 30 2018
upgrade fpd auto
version 15.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
aqm-register-fnf
!
!
no aaa new-model
no ip icmp rate-limit unreachable
!
!
!
!
!
!
no ip domain lookup
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
redundancy
!
!
ip tcp synwait-time 5
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco address 12.1.1.1
!
!
crypto ipsec transform-set IPSEC-TRANSFORM-SET esp-aes esp-sha-hmac
mode tunnel
!
crypto ipsec profile IPSEC-PROFILE
set transform-set IPSEC-TRANSFORM-SET
!
!
!
!
!
!
!
!
interface Loopback0
ip address 3.3.3.3 255.255.255.255
!
interface Tunnel1
ip address 13.1.1.3 255.255.255.0
tunnel source 23.1.1.3
tunnel destination 12.1.1.1
tunnel protection ipsec profile IPSEC-PROFILE
!
interface FastEthernet0/0
no ip address
shutdown
duplex half
!
interface Serial1/0
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/2
ip address 23.1.1.3 255.255.255.0
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
router ospf 1
network 3.3.3.3 0.0.0.0 area 0
network 23.1.1.3 0.0.0.0 area 0
!
router bgp 300
bgp log-neighbor-changes
neighbor 13.1.1.1 remote-as 100
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
no cdp log mismatch duplex
!
!
!
control-plane
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
gatekeeper
shutdown
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line vty 0 4
login
transport input all
!
!
end
R3#
====================================================================
Drop these commands in to R1 to quickly clear counters and load show commands for ready up arrow usage........
enable
clear logging
clear access-list counters
show access-lists
show logging | include ACCESS
.
