WEBVTT

1
00:00.000 --> 00:04.480
When we're talking about the data plane tunnels, we know that one when edge

2
00:04.480 --> 00:06.640
device needs to communicate to another,

3
00:06.640 --> 00:12.400
when edge device and form a tunnel, ideally an IPsec tunnel at the data plane.

4
00:12.400 --> 00:18.240
And at that point, we are going to be able to send end user traffic through

5
00:18.240 --> 00:21.880
that tunnel across whatever the circuit type is there in the middle.

6
00:21.880 --> 00:24.720
Maybe it's MPLS or it could even be the internet.

7
00:24.720 --> 00:32.470
But the question here is how exactly do we facilitate the creation of this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

7
00:24.720 --> 00:32.470
But the question here is how exactly do we facilitate the creation of this

8
00:32.470 --> 00:33.720
tunnel?

9
00:33.720 --> 00:40.570
For example, I need to know the IP address here of how to connect, but I also

10
00:40.570 --> 00:43.560
need to know a lot of information about the other side.

11
00:43.560 --> 00:46.820
If I'm coming from the perspective of the router on the left, I need to know

12
00:46.820 --> 00:51.110
how to connect to this device, but importantly, I need to know information so I

13
00:51.110 --> 00:52.280
can decide,

14
00:52.280 --> 00:57.100
should I even form a tunnel? I mean, is a tunnel what we want to form

15
00:57.100 --> 01:00.560
specifically to this device across this circuit?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:57.100 --> 01:00.560
specifically to this device across this circuit?

16
01:00.560 --> 01:03.960
And so this information is kind of interesting.

17
01:03.960 --> 01:10.730
And what Cisco and SD-WAN solution does is it represents this information in

18
01:10.730 --> 01:15.160
the form of a transport locator,

19
01:15.160 --> 01:20.400
otherwise known as a T-lock.

20
01:20.400 --> 01:24.950
This T-lock is interesting because it's actually what we call a three-tool of

21
01:24.950 --> 01:29.720
information, meaning that we're going to pair up three different components to

22
01:29.720 --> 01:31.880
form one identifier,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

22
01:29.720 --> 01:31.880
form one identifier,

23
01:31.880 --> 01:34.240
that we call the T-lock.

24
01:34.240 --> 01:39.920
And so the three-tool consists, first of all, of a system IP.

25
01:39.920 --> 01:45.920
And yes, the system IP is an IP address, but it's not necessarily going to be a

26
01:45.920 --> 01:47.600
routable IP address.

27
01:47.600 --> 01:52.200
In other words, I'm not going to use this system IP to this remote router.

28
01:52.200 --> 01:57.100
So maybe it's a loopback on this router that's not at all part of the routing

29
01:57.100 --> 01:57.880
domain.

30
01:57.880 --> 02:01.840
That's perfectly fine. I just need to use this as an identifier.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
01:57.880 --> 02:01.840
That's perfectly fine. I just need to use this as an identifier.

31
02:01.840 --> 02:06.480
So I know if I see another T-lock because a router can actually have multiple T

32
02:06.480 --> 02:11.360
-locks that, hey, all three of these T-locks belong to the same router.

33
02:11.360 --> 02:15.080
The next component of a T-lock is the color.

34
02:15.080 --> 02:21.900
The color is one of many different predefined strings, which is essentially a

35
02:21.900 --> 02:25.320
description of the WAN circuit.

36
02:25.320 --> 02:27.200
And that's the important part about this.

37
02:27.200 --> 02:34.040
It's supposed to represent a particular circuit inside of our SD-WAN topology.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
02:27.200 --> 02:34.040
It's supposed to represent a particular circuit inside of our SD-WAN topology.

38
02:34.040 --> 02:40.280
So if I have a router and I've got a circuit connection to the MPLS space,

39
02:40.280 --> 02:45.040
and I also have a circuit through another service provider, maybe it's another

40
02:45.040 --> 02:47.400
MPLS circuit, maybe it's the internet,

41
02:47.400 --> 02:52.330
but we have two different transport mechanisms here coming in as two different

42
02:52.330 --> 02:53.400
WAN circuits.

43
02:53.400 --> 02:56.520
Well, I would assign a different color to each one of these.

44
02:56.520 --> 02:59.360
And this color could truly be a color.

45
02:59.360 --> 03:04.160
As Cisco allows us to assign things like red and green.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
02:59.360 --> 03:04.160
As Cisco allows us to assign things like red and green.

46
03:04.160 --> 03:07.560
And so I could assign red to one and green to the other.

47
03:07.560 --> 03:11.600
We also have silver, bronze, and gold colors that we can assign.

48
03:11.600 --> 03:15.290
So it's a little bit more of a, hey, this is my gold color, and this is my

49
03:15.290 --> 03:18.120
silver color from a quality perspective.

50
03:18.120 --> 03:22.630
And they also have a few other strings that represent circuit types like MPLS

51
03:22.630 --> 03:23.440
and 3G.

52
03:23.440 --> 03:28.380
But either way, I'm going to choose globally what the color for each one of my

53
03:28.380 --> 03:29.520
WAN circuits is.

54
03:29.520 --> 03:34.760
And I want to make sure that I associate the same color to each one of those.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
03:29.520 --> 03:34.760
And I want to make sure that I associate the same color to each one of those.

55
03:34.760 --> 03:39.060
Now, this is interesting because if I have different colors, again, let's just

56
03:39.060 --> 03:40.640
use red and green here.

57
03:40.640 --> 03:43.200
And that's part of my transport locator.

58
03:43.200 --> 03:48.940
This probably implies what I said earlier, which is we can actually have

59
03:48.940 --> 03:51.320
multiple T-locks.

60
03:51.320 --> 03:58.160
In fact, we usually will find that we have a T-lock per WAN circuit.

61
03:58.160 --> 04:02.990
So if I have these two WAN circuits on the left, I'm going to have a T-lock
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
03:58.160 --> 04:02.990
So if I have these two WAN circuits on the left, I'm going to have a T-lock

62
04:02.990 --> 04:04.560
that represents the one.

63
04:04.560 --> 04:07.680
And I'm going to have a T-lock over here that represents the other.

64
04:07.680 --> 04:12.520
And we can start to think about the T-lock as if it's an interface, but it's

65
04:12.520 --> 04:15.000
also an interface without an IP address.

66
04:15.000 --> 04:18.120
It's not the same thing as a layer 3 interface.

67
04:18.120 --> 04:23.550
It's just a logical connector, or again, just start calling it a T-lock that we

68
04:23.550 --> 04:28.640
use to connect to other SD-WAN routers across the WAN circuits.

69
04:28.640 --> 04:33.720
Now, the last component in all of this is the encapsulation method.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
04:28.640 --> 04:33.720
Now, the last component in all of this is the encapsulation method.

70
04:33.720 --> 04:41.160
Which is going to be either IPsec or GRE.

71
04:41.160 --> 04:45.210
As we keep saying, ideally, it's IPsec for the sake of security, but there

72
04:45.210 --> 04:48.720
might be situations where it needs to be GRE.

73
04:48.720 --> 04:54.330
Naturally, if I've got router up here connecting to these circuits and wants to

74
04:54.330 --> 04:59.200
run IPsec and the other one wants to run GRE, that's not going to work.

75
04:59.200 --> 05:03.260
Instead, we're going to have to make sure that we share the encapsulation
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
04:59.200 --> 05:03.260
Instead, we're going to have to make sure that we share the encapsulation

76
05:03.260 --> 05:05.560
method across this particular circuit.

77
05:05.560 --> 05:10.320
So notice that when we bring all of this information together, again, we're

78
05:10.320 --> 05:15.160
essentially providing information that can be used to build out a tunnel.

79
05:15.160 --> 05:19.230
It includes information about the fact that, hey, I have this router ID and

80
05:19.230 --> 05:22.960
that will show up across potentially multiple WAN circuits.

81
05:22.960 --> 05:27.970
But then I also have a way of representing that this T-lock belongs to a

82
05:27.970 --> 05:29.760
particular WAN circuit.

83
05:29.760 --> 05:33.990
And lastly, in most cases, we don't need to think too hard about the encaps
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
05:29.760 --> 05:33.990
And lastly, in most cases, we don't need to think too hard about the encaps

84
05:33.990 --> 05:38.240
ulation method because we're going to choose one and have that available for the

85
05:38.240 --> 05:40.800
entire SD-WAN environment.

86
05:40.800 --> 05:47.800
But this does allow me to start forming tunnels from these two devices over

87
05:47.800 --> 05:50.840
here across multiple circuits.

88
05:50.840 --> 05:56.410
And so I'm going to form a tunnel here between T-locks through the MPLS

89
05:56.410 --> 06:01.810
provider, but I'm also going to form a tunnel this way, which is why we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
05:56.410 --> 06:01.810
provider, but I'm also going to form a tunnel this way, which is why we

90
06:01.810 --> 06:06.400
typically see a tunnel being formed per WAN circuit.

91
06:06.400 --> 06:09.080
If I have two WAN circuits, I've redundant connections.

92
06:09.080 --> 06:16.000
I want to form tunnels to the other SD-WAN edge devices in my network.

93
06:16.000 --> 06:20.600
And I want to create a tunnel across every single one of those WAN circuits for

94
06:20.600 --> 06:23.480
the sake of redundancy and load balancing.

95
06:23.480 --> 06:27.970
Now an important part of all of this is we notice that the IP address isn't

96
06:27.970 --> 06:30.120
actually a part of the T-lock.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
06:27.970 --> 06:30.120
actually a part of the T-lock.

97
06:30.120 --> 06:33.760
I have a potentially not-routable IP address.

98
06:33.760 --> 06:37.810
It could be routable, but I'm not going to be able to rely on it being routable

99
06:37.810 --> 06:41.840
, and so I can't use it to connect to the other side.

100
06:41.840 --> 06:47.400
Instead, we're going to find that the control plane element, specifically OMP,

101
06:47.400 --> 06:52.720
a protocol we're talking about in the next video, is going to not only share

102
06:52.720 --> 06:59.000
the T-locks among all of the different WAN edge devices, because the WAN edge

103
06:59.000 --> 07:04.490
devices need to know about the remote T-locks, but it's also going to share the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
06:59.000 --> 07:04.490
devices need to know about the remote T-locks, but it's also going to share the

104
07:04.490 --> 07:07.440
IP connection information.

105
07:07.440 --> 07:14.040
So how do you connect to this other WAN edge that has a T-lock that you want to

106
07:14.040 --> 07:15.440
connect to?

107
07:15.440 --> 07:20.830
So then the question we- the next question we might want to ask is, "All right,

108
07:20.830 --> 07:27.170
so we have a bunch of T-locks. How do we go about forming tunnels among T-locks

109
07:27.170 --> 07:27.720
?"

110
07:27.720 --> 07:32.610
And there's one overarching goal when it comes to deciding these kinds of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
07:27.720 --> 07:32.610
And there's one overarching goal when it comes to deciding these kinds of

111
07:32.610 --> 07:33.400
things.

112
07:33.400 --> 07:39.630
When we're trying to decide how to form the tunnels, a router, a WAN edge

113
07:39.630 --> 07:49.160
device wants to form a tunnel from every T-lock to every T-lock.

114
07:49.160 --> 07:53.560
Now that is some implications, doesn't it?

115
07:53.560 --> 07:59.400
So we just said that we're going to have a T-lock on each WAN circuit.

116
07:59.400 --> 08:04.540
And so if I now draw this out again, where I've got my two different service
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
07:59.400 --> 08:04.540
And so if I now draw this out again, where I've got my two different service

117
08:04.540 --> 08:12.570
providers, like this, and I know that I've got MPLS on one side and internet on

118
08:12.570 --> 08:13.480
the other side,

119
08:13.480 --> 08:19.240
that I'm going to form a WAN tunnel from one T-lock to the other via MPLS and

120
08:19.240 --> 08:21.400
one through the internet.

121
08:21.400 --> 08:27.830
So the question is, does this MPLS T-lock want to form a tunnel to the internet

122
08:27.830 --> 08:31.400
T-lock on the other side and vice versa?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
08:27.830 --> 08:31.400
T-lock on the other side and vice versa?

123
08:31.400 --> 08:35.970
And the answer is absolutely yes. It wants to form a tunnel from every T-lock

124
08:35.970 --> 08:37.400
to every T-lock.

125
08:37.400 --> 08:42.760
This gives us redundancy and it maximizes, again, our load balancing.

126
08:42.760 --> 08:50.830
It maximizes our options if we have multiple connections. From a real world

127
08:50.830 --> 08:57.980
perspective, can this MPLS T-lock connect to this internet IP address through

128
08:57.980 --> 08:59.400
the MPLS circuit?

129
08:59.400 --> 09:03.440
Probably not, but we might actually find, especially on the internet with
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

129
08:59.400 --> 09:03.440
Probably not, but we might actually find, especially on the internet with

130
09:03.440 --> 09:05.480
public IP addresses, that we can.

131
09:05.480 --> 09:09.940
And this gets even more likely if this isn't an MPLS circuit, but another

132
09:09.940 --> 09:14.880
internet circuit. Because the two internet worlds are not really separate

133
09:14.880 --> 09:15.320
clouds,

134
09:15.320 --> 09:19.120
unless we're building it over a DMVPN or something like that, if we're just

135
09:19.120 --> 09:21.640
using the raw internet, and these are connected.

136
09:21.640 --> 09:27.210
And it's just a bunch of public IP addresses, at which point I will see a full

137
09:27.210 --> 09:32.200
mesh of tunnels be formed across these two different T-locks.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

137
09:27.210 --> 09:32.200
mesh of tunnels be formed across these two different T-locks.

138
09:32.200 --> 09:39.250
What if I don't want this? Well, I do have the option as an admin, and I can

139
09:39.250 --> 09:45.160
lock this down to only consider T-locks of the same color.

140
09:45.160 --> 09:50.320
It's one of the reasons why we share the color information, and that will make

141
09:50.320 --> 09:55.220
it so we don't actually even try to form these tunnels between T-locks that are

142
09:55.220 --> 09:56.760
part of different colors,

143
09:56.760 --> 10:01.110
which ultimately means they're part of different WAN circuits. Now, one last
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

143
09:56.760 --> 10:01.110
which ultimately means they're part of different WAN circuits. Now, one last

144
10:01.110 --> 10:06.240
fun part about forming tunnels via T-locks is what happens if I have a

145
10:06.240 --> 10:10.200
redundant network with two routers,

146
10:10.200 --> 10:15.100
maybe running a first-hop redundancy protocol between them. And then I say, all

147
10:15.100 --> 10:17.080
right, I've got these two different WAN circuits.

148
10:17.080 --> 10:21.560
I'm going to bring one of them into one router, and the other one into the

149
10:21.560 --> 10:22.680
other router.

150
10:22.680 --> 10:27.830
So here's my MPLS, here's my internet, or whatever the situation is there. That

151
10:27.830 --> 10:34.270
's kind of interesting, because now, if I'm forming a IP-seq tunnel through the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

151
10:27.830 --> 10:34.270
's kind of interesting, because now, if I'm forming a IP-seq tunnel through the

152
10:34.270 --> 10:35.960
MPLS, and this MPLS goes down,

153
10:35.960 --> 10:40.880
this router has just lost connection to the SD-WAN environment, which is not

154
10:40.880 --> 10:46.200
ideal. We want to use the overlay and use these tunnels to try to stay up,

155
10:46.200 --> 10:52.040
but the problem is I can't form a tunnel through the internet to the other rout

156
10:52.040 --> 10:56.040
ers, simply because I'm not connected to the internet.

157
10:56.040 --> 11:02.650
The other router is. So what we can do is use the concept of a T-lock extension
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

157
10:56.040 --> 11:02.650
The other router is. So what we can do is use the concept of a T-lock extension

158
11:02.650 --> 11:03.080
.

159
11:03.080 --> 11:08.520
The T-lock extension allows me to actually go through the other router in order

160
11:08.520 --> 11:10.440
to form my other tunnel.

161
11:10.440 --> 11:15.440
So as we draw the tunnels out, now I can form tunnels. Let's just say we've got

162
11:15.440 --> 11:19.960
a device out there, another WAN edge that has a connection into both.

163
11:19.960 --> 11:25.820
So I can form my tunnel this way, and my tunnel this way, but now I can

164
11:25.820 --> 11:28.920
actually use this T-lock extension here,

165
11:28.920 --> 11:34.120
and the T-lock extension allows me to have a T-lock in the internet color,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

165
11:28.920 --> 11:34.120
and the T-lock extension allows me to have a T-lock in the internet color,

166
11:34.120 --> 11:38.760
whatever that color is, and I go through the other router

167
11:38.760 --> 11:43.120
to form my tunnel. And naturally I do it the other way around as well. This

168
11:43.120 --> 11:45.960
router has a T-lock in the MPLS color,

169
11:45.960 --> 11:52.060
and it allows me to use the local network to communicate over to the other

170
11:52.060 --> 11:54.280
router and out the MPLS circuit.

171
11:54.280 --> 11:57.620
And I could use the local network, or I could actually have a layer three

172
11:57.620 --> 12:00.120
interface between them, specifically for this purpose,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

172
11:57.620 --> 12:00.120
interface between them, specifically for this purpose,

173
12:00.120 --> 12:04.200
which is typically how we'd want to do that if we have the luxury of doing so.

174
12:04.200 --> 12:12.150
So this T-lock extension can support redundant routers that each have a single

175
12:12.150 --> 12:13.800
WAN circuit.

176
12:13.800 --> 12:20.250
Very useful in a situation where I just don't have the luxury of connecting

177
12:20.250 --> 12:22.520
both WAN circuits to both routers.

178
12:22.520 --> 12:26.400
In a perfect world, that's what we would do is we would just give each router

179
12:26.400 --> 12:28.920
its own connection to both WAN circuits,

180
12:28.920 --> 12:33.680
but again, real world scenarios. I don't always play by the rules, or at least
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

180
12:28.920 --> 12:33.680
but again, real world scenarios. I don't always play by the rules, or at least

181
12:33.680 --> 12:35.160
the desirable rules.

182
12:35.160 --> 12:39.630
And so this T-lock extension gives us a great option for maintaining the value

183
12:39.630 --> 12:43.160
of having many tunnels across many different WAN circuits,

184
12:43.160 --> 12:47.160
even if I don't have a direct connection to those WAN circuits.