Hello experts, I'm interested to know if on the Cisco ASA there is a way to view the IKE encryption keys. More specifically, I want to do a packet capture in GNS3 (consider this a whitehat experiment) and decrypt IKE_Auth packets which are encrypted with keys negotiated in the IKE_SA_INIT exchange. Wireshark offers this functionality from Main Menu -> Preferences -> Protocols -> ISAKMP.  Is there any way (show command, debug, logs) to get these values (SK_ei, SK_er, SK_ai, SK_ar) for any particular IKE SA on the ASA ? ... View more

Hi all,   I'm at the NAT chapter on my Cisco prep and I have the following question.    Is it possible to do dynamic source and destination NAT at the same time ? If so, then how ?   More specifically what I'm trying to achieve.   The router R2 from the figure above is the one that is supposed to be performing NAT. Router R1 with the loopback 192.168.10.1 is on the inside, and router J1 (it's a Juniper vMX :) ) is on the outside.   What I'm trying to do is at the same time change both the source and destination address when pinging from R1 to J1 at R2. For some reason, this does not seem to work. Am I missing a configuration knob or is this just not possible. I'm not excluding the latter option given that a dynamic mapping of both the source and destination address will mean very inconsistent flows, especially if the translation timer is very low.    The relevant configuration on R2.   interface FastEthernet1/0  ip address 10.1.1.2 255.255.255.252  ip nat inside  ip virtual-reassembly   interface FastEthernet2/0  ip address 100.1.1.1 255.255.255.0  ip nat outside  ip virtual-reassembly   ip route 101.1.1.0 255.255.255.248 100.1.1.2 ip route 192.168.10.0 255.255.255.248 10.1.1.1   ip nat pool nat-pool-in 50.1.1.1 50.1.1.254 prefix-length 24 ip nat pool nat-pool-out 172.16.10.1 172.16.10.254 prefix-length 24 ip nat inside source list nat-list-in pool nat-pool-in ip nat outside source list nat-outside-list pool nat-pool-out ! ip access-list extended nat-list-in permit ip 10.1.1.0 0.0.0.3 any permit ip 192.168.10.0 0.0.0.7 any ip access-list extended nat-outside-list permit ip 101.1.1.0 0.0.0.7 any permit ip 100.1.1.0 0.0.0.255 any !   The nat-list-in access list defines the I.L address space, and the nat-pool-in defines the I.G address space. The nat-list-out access list defines the O.L address space, and the nat-pool-out defines the O.G address space   When I ping 172.16.10.x from 192.168.10.x , I want the S.A. to be changed dynamically from 192.168.10.x to an address from the 50.1.1.0/24 network, while the D.A. should be changed from 172.16.10.x to 101.1.1.x. Both translations should be done in a single step, at R2.    R1 has a route in the FIB for 172.16.10.0/24 and J1 has a route for the destination 50.1.1.0/24, both pointing to their respective next hops at R2.   Regards, Ciprian Chira ... View more