WEBVTT

1
00:02.550 --> 00:07.320
So now we're gonna move into using redundant edge devices

2
00:07.320 --> 00:10.560
for the connectivity to AWS.

3
00:10.560 --> 00:12.600
So we're gonna be using not just router one,

4
00:12.600 --> 00:13.980
but we're gonna be bringing router two

5
00:13.980 --> 00:16.020
into the environment as well.

6
00:16.020 --> 00:19.740
Now, this is overall a fairly straightforward process.

7
00:19.740 --> 00:24.740
However, our clients such as workstation one in our example,

8
00:24.870 --> 00:28.230
have to have a common default gateway they can use

9
00:28.230 --> 00:30.330
in the event of a failure.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:28.230 --> 00:30.330
in the event of a failure.

10
00:30.330 --> 00:31.800
This is a perfect place

11
00:31.800 --> 00:34.680
to use a first hop redundancy protocol

12
00:34.680 --> 00:36.660
such as HSRP

13
00:36.660 --> 00:38.790
or VRRP.

14
00:38.790 --> 00:42.420
Now, the first of those is of course, Cisco proprietary.

15
00:42.420 --> 00:45.000
It's the Hot Standby Routing Protocol,

16
00:45.000 --> 00:48.540
and the second Virtual Router Redundancy Protocol

17
00:48.540 --> 00:50.700
is the industry standard.

18
00:50.700 --> 00:54.420
Now, you can use whichever one you want in your environment.

19
00:54.420 --> 00:58.260
We're going to use VRRP mostly just because

20
00:58.260 --> 01:00.300
people aren't quite as familiar with it,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
00:58.260 --> 01:00.300
people aren't quite as familiar with it,

21
01:00.300 --> 01:03.090
and I thought that would be a better option to show here.

22
01:03.090 --> 01:06.420
If you would rather do HSRP as you follow along,

23
01:06.420 --> 01:08.400
that's perfectly fine as well.

24
01:08.400 --> 01:10.110
Everything we're going to do

25
01:10.110 --> 01:13.620
including the things we're gonna do in our challenge,

26
01:13.620 --> 01:16.590
can be done with HSRP as well.

27
01:16.590 --> 01:18.060
So let's go ahead and jump in

28
01:18.060 --> 01:21.993
and take a look at configuring VRRP on our routers.

29
01:24.600 --> 01:27.180
So as we jump in here and get started,

30
01:27.180 --> 01:30.960
we have to pick which IP addresses we're going to be using.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
01:27.180 --> 01:30.960
we have to pick which IP addresses we're going to be using.

31
01:30.960 --> 01:34.830
Now for the default gateway, the most common things to do

32
01:34.830 --> 01:38.850
are to use either .1 or .254

33
01:38.850 --> 01:40.380
on a given subnet

34
01:40.380 --> 01:42.240
for the default gateway.

35
01:42.240 --> 01:45.780
Personally, I prefer to use .1

36
01:45.780 --> 01:48.030
so if we choose to use .1

37
01:48.030 --> 01:50.610
we do sort of have a problem because right now,

38
01:50.610 --> 01:53.820
router one is already using .1.

39
01:53.820 --> 01:57.900
Now, technically with VRRP, we could still use .1

40
01:57.900 --> 01:59.610
for the virtual gateway

41
01:59.610 --> 02:03.240
because VRRP does allow one of the physical routers
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:59.610 --> 02:03.240
because VRRP does allow one of the physical routers

42
02:03.240 --> 02:05.880
to use its virtual IP address,

43
02:05.880 --> 02:08.340
that one just has to be the master.

44
02:08.340 --> 02:12.480
However, since I realize some people may use HSRP for this,

45
02:12.480 --> 02:16.260
we will still use the three IP address model.

46
02:16.260 --> 02:19.680
So what we're gonna do is, we're gonna move router one

47
02:19.680 --> 02:21.960
to be .2 on the subnet.

48
02:21.960 --> 02:25.800
We'll move router two to be .3 on the subnet,

49
02:25.800 --> 02:28.980
and then we'll put our gateway at the .1.

50
02:28.980 --> 02:32.250
So it's a simple matter of enabling VRRP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
02:28.980 --> 02:32.250
So it's a simple matter of enabling VRRP

51
02:32.250 --> 02:34.410
and changing the IP address.

52
02:34.410 --> 02:36.780
So let's go ahead and jump in and do that.

53
02:36.780 --> 02:39.870
We'll actually start our configuration on router two,

54
02:39.870 --> 02:43.560
just because we're less likely to get an IP address conflict

55
02:43.560 --> 02:45.030
as we configure this.

56
02:45.030 --> 02:46.530
We could still get one,

57
02:46.530 --> 02:48.690
because we are gonna be duplicating IP addresses

58
02:48.690 --> 02:49.890
for just a moment.

59
02:49.890 --> 02:52.380
So let's jump in here to router two.

60
02:52.380 --> 02:53.850
We'll go into configuration mode.

61
02:53.850 --> 02:56.010
This is interface gigabit two

62
02:56.010 --> 03:00.270
that's facing the client device workstation one,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
02:56.010 --> 03:00.270
that's facing the client device workstation one,

63
03:00.270 --> 03:03.060
and we'll change its IP address

64
03:03.060 --> 03:06.180
to 10.10.10.3.

65
03:06.180 --> 03:08.730
This will of course still be a slash 24.

66
03:08.730 --> 03:11.370
And then we'll fire up VRRP.

67
03:11.370 --> 03:13.080
We need to give it a group number.

68
03:13.080 --> 03:14.940
We'll just say group one.

69
03:14.940 --> 03:16.650
And for the virtual IP,

70
03:16.650 --> 03:19.650
we're going to use the 10.10.10.1.

71
03:19.650 --> 03:22.860
Now, again, router one is still using this address right now

72
03:22.860 --> 03:26.190
so we could potentially get an IP address conflict.

73
03:26.190 --> 03:28.920
But for right now, we can safely ignore that.

74
03:28.920 --> 03:30.960
So we'll go ahead and hit enter,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

74
03:28.920 --> 03:30.960
So we'll go ahead and hit enter,

75
03:30.960 --> 03:32.580
we'll exit configuration,

76
03:32.580 --> 03:34.890
and we'll jump over to router one.

77
03:34.890 --> 03:37.170
Router one's almost the same configuration,

78
03:37.170 --> 03:39.660
it's interface gigabit two.

79
03:39.660 --> 03:44.017
We need to change its IP address to 10.10.10.2

80
03:46.440 --> 03:48.330
and once again,

81
03:48.330 --> 03:52.830
VRRP one IP is 10.10.10.1

82
03:52.830 --> 03:55.260
for the virtual IP address.

83
03:55.260 --> 03:57.420
And we'll exit configuration.

84
03:57.420 --> 04:00.120
So if we give this just a moment to converge,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
03:57.420 --> 04:00.120
So if we give this just a moment to converge,

85
04:00.120 --> 04:03.000
and then we say, "show VRRP",

86
04:03.000 --> 04:05.670
we can see that this is up and running correctly.

87
04:05.670 --> 04:09.510
We see that we have group one, its current state is backup.

88
04:09.510 --> 04:11.010
That's because, of course, we'll verify

89
04:11.010 --> 04:14.070
router two in a moment, but it should be the master.

90
04:14.070 --> 04:19.070
And then we have the virtual IP address is the 10.10.10.1

91
04:19.260 --> 04:22.920
and of course, the other aspects of VRRP here,

92
04:22.920 --> 04:27.920
including telling us that the master router is 10.10.10.3.

93
04:28.560 --> 04:31.710
Now, as we can see here, our priority is 100,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
04:28.560 --> 04:31.710
Now, as we can see here, our priority is 100,

94
04:31.710 --> 04:34.533
and the priority of the master is 100.

95
04:35.670 --> 04:37.987
Now, this does sort of beg the question,

96
04:37.987 --> 04:40.770
"Why did router two become the master?"

97
04:40.770 --> 04:43.530
And it's not because we configured it first.

98
04:43.530 --> 04:47.490
It's quite simply because it has the higher IP address.

99
04:47.490 --> 04:49.920
In the event of a tie with the priority,

100
04:49.920 --> 04:52.590
which, as we can see, we didn't configure it,

101
04:52.590 --> 04:56.760
so it defaults to 100, just like HSRP does,

102
04:56.760 --> 04:58.740
the highest priority wins.

103
04:58.740 --> 05:01.080
But again, in the event of a tie,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
04:58.740 --> 05:01.080
But again, in the event of a tie,

104
05:01.080 --> 05:03.450
it's going to be the highest IP address.

105
05:03.450 --> 05:08.040
Since .3 on router two is higher than .2 on router one,

106
05:08.040 --> 05:10.350
router two is going to win here.

107
05:10.350 --> 05:13.320
Now, potentially there's nothing wrong with that.

108
05:13.320 --> 05:18.150
However, we happen to know from our previous testing

109
05:18.150 --> 05:21.750
that we're actually using tunnel one

110
05:21.750 --> 05:26.010
on router one, from the BGP perspective.

111
05:26.010 --> 05:27.720
Remember when we turned on BGP,

112
05:27.720 --> 05:30.870
we saw which routes being put into the routing table
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
05:27.720 --> 05:30.870
we saw which routes being put into the routing table

113
05:30.870 --> 05:33.660
and it's preferring tunnel one.

114
05:33.660 --> 05:36.000
So the best thing to do in this case

115
05:36.000 --> 05:37.410
is simply going to be

116
05:37.410 --> 05:39.480
to make router one the master.

117
05:39.480 --> 05:43.380
Now, once of course, we set up our VPN to router two,

118
05:43.380 --> 05:45.000
it may not matter much,

119
05:45.000 --> 05:47.700
but in this case, just for the sake of practice,

120
05:47.700 --> 05:50.133
let's go ahead and make router one the master.

121
05:51.360 --> 05:52.350
Before we do that though,

122
05:52.350 --> 05:55.380
we will of course verify router two.

123
05:55.380 --> 05:58.950
Show VRRP, we see that is in fact, the master,

124
05:58.950 --> 06:01.200
which we pretty much already knew.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

124
05:58.950 --> 06:01.200
which we pretty much already knew.

125
06:01.200 --> 06:04.050
So now let's make router one the master.

126
06:04.050 --> 06:06.570
All we have to do is go back into configuration,

127
06:06.570 --> 06:10.410
back into our interface, and for VRRP one,

128
06:10.410 --> 06:14.070
set the priority to something higher than 100.

129
06:14.070 --> 06:16.560
110, perfectly fine.

130
06:16.560 --> 06:18.360
End our configuration.

131
06:18.360 --> 06:20.970
Give it just a moment to converge.

132
06:20.970 --> 06:22.770
Say, "show VRRP."

133
06:22.770 --> 06:24.900
We can see now we are the master

134
06:24.900 --> 06:27.210
with a priority of 110,

135
06:27.210 --> 06:29.430
and it tells us that the master router

136
06:29.430 --> 06:32.610
is the local router with that priority.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
06:29.430 --> 06:32.610
is the local router with that priority.

137
06:32.610 --> 06:34.260
And of course, that means that router two

138
06:34.260 --> 06:35.703
should now be backup.

139
06:36.810 --> 06:39.570
We see here on router two that it is in fact backup.

140
06:39.570 --> 06:42.300
So VRRP is working correctly.

141
06:42.300 --> 06:45.030
One final step, we should make sure that workstation one

142
06:45.030 --> 06:47.730
can in fact still ping its gateway.

143
06:47.730 --> 06:50.580
So we'll ping the 10.10.10.1.

144
06:50.580 --> 06:52.950
We can see that this is successful.

145
06:52.950 --> 06:55.530
Now, the real question at this point is,

146
06:55.530 --> 06:59.220
can workstation one actually reach AWS?

147
06:59.220 --> 07:03.270
So if we were to say ping 10.20.20.32
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

147
06:59.220 --> 07:03.270
So if we were to say ping 10.20.20.32

148
07:03.270 --> 07:07.080
this is going to work because router one is the master

149
07:07.080 --> 07:10.980
and router one has VPNs that are functioning.

150
07:10.980 --> 07:15.480
Remember, we haven't configured VPNs for router two yet.

151
07:15.480 --> 07:17.910
So if our traffic was going to router two,

152
07:17.910 --> 07:19.443
it wouldn't be going anywhere.

153
07:22.170 --> 07:23.760
So in this video,

154
07:23.760 --> 07:27.270
we saw how to configure a first hop redundancy protocol

155
07:27.270 --> 07:29.670
to get our redundant edge routers

156
07:29.670 --> 07:33.930
ready to provide redundancy to the AWS cloud.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

156
07:29.670 --> 07:33.930
ready to provide redundancy to the AWS cloud.

157
07:33.930 --> 07:38.250
Now, of course, we need to set up that second VPN connection

158
07:38.250 --> 07:39.630
for router two,

159
07:39.630 --> 07:42.180
and that's exactly what we're gonna jump into next.