We just finished configuring and analyzing the two modes
that are available to us in IKE phase 1,
main and aggressive mode.
Those are the modes that help us create the IPsec SAs so that we can
utilize their security to properly build up the IPsec SAs.
Building the IPsec SA is what's known as IKE phase 2,
and there's only one mode to talk about here,
quick mode.
So quick mode is what establishes the actual IPsec
connection based on the policies.
We're about to hop in the lab and see this portion of the exchanges in action.
We'll take are already configured IPsec connections from the previous
demo and analyze the quick mode packets that we had.
We'll discuss what the exchange between the two
devices is actually doing as well.
This should be a fun one since we'll just be
investigating what's happening inside of the SAs.
Alright, the next demo we're doing is all about quick mode.
We're not configuring anything in this one,
but instead,
we're going to just check out the packets in Wireshark and see what we can see.
This is the same capture that we used in the previous demo,
so you can pull it back up.
If you need to get a hold of the course materials,
including the configurations and PCAPs,
they're in the exercise files for the course for downloading.
Let's jump in and look at this first packet that's in quick mode,
which again is the phase 2 mode of the IKE protocol set.
It's the one that actually establishes our IPsec SA securely.
Here,
you can see that we're using the default port of 500 for
the exchanges still and that we have the ISAKMP SPIs
already designated and established.
As you can see, we can't see any of the data within this set of SAs though.
We can't see anything about the quick mode's process.
All we have available to us is this block of encrypted data that we would
need to try to decrypt to be able to see what's inside.
Outsiders would be there for a very long time trying to do just that.
And looking at the other two packets in this exchange,
this shows us pretty much the same information.
This proves to us that the IPsec information is being
securely exchanged in all of these packets.
This is due to the phase 1 SAs being built.
That parent-child relationship hopefully makes a little bit
more sense now that we discussed it before.
The ISAKMP SAs in phase 1 are created so that the IPsec data is
encrypted for establishing their own SAs.
This is one of the benefits of how IPsec functions in general.
It provides the ability to gain additional security,
even from the initial establishment.
As we've covered before, once the IPsec tunnels are up and operational,
the traffic can be sent via IPsec to the peer.
Using ESP, we see all of these ESP packets,
not the actual ICMP packets that we used during the ping test.
To summarize the process, first, we identify the interesting traffic.
After that, we start phase 1, which is either main mode or aggressive mode.
Then, phase 2 kicks in where we use quick mode. Finally, the traffic is sent, and it's protected by IPsec.