So I have a question about IPSec.
For example, we have an extended ACL with one line
10.10.10.0/24 10.20.20.0/24 on one side (R1)
10.20.20.0/24 10.10.10.0/24 on the other (R2).
When we see traffic coming from an encrypted channel what does the router perform first (besides correlating packet's SPI to a connection)?
I also have a hard time understanding the crypto map ACL part, do we look into it when we are getting IPSec traffic, and if we do, why there is only one line for 10.10.10.0 to 10.20.20.0 and no 10.20.20.0 to 10.10.10.0 for ingress traffic (R1)?
I was talking about ACL that is a part of crypto map probably it's because of my horrendous english. Here is the Cisco config:
int fa0/0 ip 18.104.22.168 crypto map myIPsecMap crypto map myIPsecMap set transform-set ... match address myACL myACL permit ip 10.10.10.0/24 10.20.20.0/24
When we send traffic from that router we check if it's from 10.10.10.0/24 and going to 10.20.20.0/24 then we crypt it (pure IPsec, no GRE), but when we are getting encrypted traffic i heard that we also look into that ACL (e.g. myACL) to check if it's from 10.20.20.0/24 and going to 10.10.10.0/24 (i guess it's more of a question about ACL rather than IPsec itself)
Ok, I checked it myself and indeed it does look in my ACL and if I dont add IP's on both sides Isakmp tunnel hangs on negotiating, i got it, for me it was very counterintuitive to think about ACL in that revesed way