2 added 123 characters in body
source | link

Two cases, two possibilities:

You could initiate a client connection from your laptop to the cisco, than a second connection from the cisco to the final target:

<laptop> ---- <cisco> ... <cisco> ---- <final>

In this case, datas will transit in clear at cisco host.

Or you could initiate a client connection from your laptop to the cisco, than a second connection from your laptop to the final target:

<laptop> ---- <cisco> .... <final>
<laptap><laptop> ----------------- <final>

In this case (while both encryption tunnels are initiated successively from the same host: the laptop), it will be a tunnel within a tunneltunnel within a tunnel and cisco won't see unencrypted datas.

Nota: In this,

----  mean encrypted connection and
....  mean unencrypted (local or network) connection

Two cases, two possibilities:

You could initiate a client connection from your laptop to the cisco, than a second connection from the cisco to the final target:

<laptop> ---- <cisco> ... <cisco> ---- <final>

In this case, datas will transit in clear at cisco host.

Or you could initiate a client connection from your laptop to the cisco, than a second connection from your laptop to the final target:

<laptop> ---- <cisco> .... <final>
<laptap> ----------------- <final>

In this case, it will be a tunnel within a tunnel and cisco won't see unencrypted datas.

Two cases, two possibilities:

You could initiate a client connection from your laptop to the cisco, than a second connection from the cisco to the final target:

<laptop> ---- <cisco> ... <cisco> ---- <final>

In this case, datas will transit in clear at cisco host.

Or you could initiate a client connection from your laptop to the cisco, than a second connection from your laptop to the final target:

<laptop> ---- <cisco> .... <final>
<laptop> ----------------- <final>

In this case (while both encryption tunnels are initiated successively from the same host: the laptop), it will be a tunnel within a tunnel and cisco won't see unencrypted datas.

Nota: In this,

----  mean encrypted connection and
....  mean unencrypted (local or network) connection
1
source | link

Two cases, two possibilities:

You could initiate a client connection from your laptop to the cisco, than a second connection from the cisco to the final target:

<laptop> ---- <cisco> ... <cisco> ---- <final>

In this case, datas will transit in clear at cisco host.

Or you could initiate a client connection from your laptop to the cisco, than a second connection from your laptop to the final target:

<laptop> ---- <cisco> .... <final>
<laptap> ----------------- <final>

In this case, it will be a tunnel within a tunnel and cisco won't see unencrypted datas.