So I have a question about IPSec.
For example, we have an extended ACL with one line 10.10.10.0/24 10.20.20.0/24
on one side (R1)
and 10.20.20.0/24 10.10.10.0/24
on the other (R2).
When we see traffic coming from an encrypted channel what does the router perform first (besides correlating packet's SPI to a connection)?
I also have a hard time understanding the crypto map ACL part, do we look into it when we are getting IPSec traffic, and if we do, why there is only one line for 10.10.10.0 to 10.20.20.0 and no 10.20.20.0 to 10.10.10.0 for ingress traffic (R1)?
upd:
I was talking about ACL that is a part of crypto map probably it's because of my horrendous english. Here is the Cisco config:
int fa0/0
ip 1.2.3.4
crypto map myIPsecMap
crypto map myIPsecMap
set transform-set ...
match address myACL
myACL
permit ip 10.10.10.0/24 10.20.20.0/24
When we send traffic from that router we check if it's from 10.10.10.0/24 and going to 10.20.20.0/24 then we crypt it (pure IPsec, no GRE), but when we are getting encrypted traffic i heard that we also look into that ACL (e.g. myACL) to check if it's from 10.20.20.0/24 and going to 10.10.10.0/24 (i guess it's more of a question about ACL rather than IPsec itself)
..
Ok, I checked it myself and indeed it does look in my ACL and if I dont add IP's on both sides Isakmp tunnel hangs on negotiating, i got it, for me it was very counterintuitive to think about ACL in that revesed way