WEBVTT

1
00:00.000 --> 00:07.320
So before we just jump in and begin our configuration, it's very important, of

2
00:07.320 --> 00:08.440
course, to put together

3
00:08.440 --> 00:12.880
a game plan so we know exactly what it is we're trying to accomplish.

4
00:12.880 --> 00:17.530
So let's start off here by bringing up our topology diagram, talking about the

5
00:17.530 --> 00:18.680
environment,

6
00:18.680 --> 00:22.430
what's already built, and if it's not how to build it, and then we'll talk

7
00:22.430 --> 00:23.040
about what

8
00:23.040 --> 00:28.200
it is we're going to accomplish in this skill as far as building our VPN and

9
00:28.200 --> 00:29.440
the reachability

10
00:29.440 --> 00:31.840
that we expect after that's complete.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:29.440 --> 00:31.840
that we expect after that's complete.

11
00:31.840 --> 00:37.160
So that said, let's jump in to our topology diagram.

12
00:37.160 --> 00:41.710
So let's begin here by talking about this top section of our network, which is

13
00:41.710 --> 00:42.200
acting

14
00:42.200 --> 00:49.400
as the on-prem, or sometimes we'll refer to it as the headquarters site.

15
00:49.400 --> 00:51.800
Now a few things to note here.

16
00:51.800 --> 00:57.080
This configuration should already be built from previous skills.

17
00:57.080 --> 01:02.800
However, we want to make sure that we baseline the configuration on R1 and R2.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

17
00:57.080 --> 01:02.800
However, we want to make sure that we baseline the configuration on R1 and R2.

18
01:02.800 --> 01:07.340
We will be starting off with these having their baseline configuration, but no

19
01:07.340 --> 01:08.120
IP second

20
01:08.120 --> 01:11.840
information or like V2 information.

21
01:11.840 --> 01:16.040
So again, step one, make sure router 1 and router 2 are baseline.

22
01:16.040 --> 01:20.710
If you don't have your on-prem location already configured, please note that

23
01:20.710 --> 01:21.400
the files

24
01:21.400 --> 01:27.580
necessary to complete this are provided below this video for both a Cisco CML

25
01:27.580 --> 01:28.720
environment

26
01:28.720 --> 01:33.670
and a non-Sysco CML environment if you're using a different form of router
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
01:28.720 --> 01:33.670
and a non-Sysco CML environment if you're using a different form of router

27
01:33.670 --> 01:34.760
virtualization

28
01:34.760 --> 01:36.440
software.

29
01:36.440 --> 01:41.630
Also important to note, as we jump in here, we do have a device here on the

30
01:41.630 --> 01:42.720
outside that's

31
01:42.720 --> 01:44.400
doing Pat.

32
01:44.400 --> 01:50.920
In my case, this just happens to be my outside firewall here at my location.

33
01:50.920 --> 01:56.910
Be aware, however, that this Pat device means that in order for IP Sec to go

34
01:56.910 --> 01:58.000
over this, we

35
01:58.000 --> 02:04.040
are going to be using something called NAT-T or NAT-Troversal.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:58.000 --> 02:04.040
are going to be using something called NAT-T or NAT-Troversal.

36
02:04.040 --> 02:09.440
This allows the traffic to go through a NAT or a Pat device.

37
02:09.440 --> 02:13.060
The way we'll see this as we look through some of our show commands later is we

38
02:13.060 --> 02:13.480
'll see

39
02:13.480 --> 02:20.200
that this is actually using port 4500 as opposed to port 500.

40
02:20.200 --> 02:22.960
So we'll see evidence of this as we go.

41
02:22.960 --> 02:27.440
Just be aware that this Pat device is in the network path.

42
02:27.440 --> 02:32.310
So that pretty much covers everything about the on-prem or the headquarters
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
02:27.440 --> 02:32.310
So that pretty much covers everything about the on-prem or the headquarters

43
02:32.310 --> 02:33.240
location.

44
02:33.240 --> 02:37.930
The other thing we want to discuss, of course, is what's going on down here in

45
02:37.930 --> 02:38.680
Microsoft

46
02:38.680 --> 02:40.000
Azure.

47
02:40.000 --> 02:44.360
So this is basically going to be a blank environment.

48
02:44.360 --> 02:50.090
As of right now, we don't really have anything configured in Azure, except in

49
02:50.090 --> 02:51.440
my case, I actually

50
02:51.440 --> 02:54.840
do already have a resource group created.

51
02:54.840 --> 03:00.030
It's called SD-WAN because I used the same resource group for the entire course
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
02:54.840 --> 03:00.030
It's called SD-WAN because I used the same resource group for the entire course

52
03:00.030 --> 03:00.080
.

53
03:00.080 --> 03:04.230
The reason I'm using that existing resource group is I do already have some

54
03:04.230 --> 03:05.800
quota limit increases

55
03:05.800 --> 03:09.640
in that resource group that I got configured by Microsoft.

56
03:09.640 --> 03:13.020
And if I start a new resource group, I would have to go through all of that

57
03:13.020 --> 03:13.560
again.

58
03:13.560 --> 03:16.160
So I'm just going to be using that existing resource group.

59
03:16.160 --> 03:19.410
If you don't have a resource group in your environment, of course, just go

60
03:19.410 --> 03:20.360
ahead and create

61
03:20.360 --> 03:21.600
one.

62
03:21.600 --> 03:25.960
But aside from that, our Azure environment is mostly blank.

63
03:25.960 --> 03:30.000
So one of the first things we're going to have to do is create a vnet or a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
03:30.000 --> 03:31.120
virtual network

65
03:31.120 --> 03:38.040
down here for this subnet 10.30.10.0/24.

66
03:38.040 --> 03:46.540
Now Azure overall is going to be responsible in our environment for 10.30.0.0/

67
03:46.540 --> 03:47.600
16.

68
03:47.600 --> 03:52.490
As we move through this entire course, Azure is effectively going to be acting

69
03:52.490 --> 03:53.600
like our site

70
03:53.600 --> 03:58.920
30, where AWS is going to be acting as site 20.

71
03:58.920 --> 04:02.480
And when we get their Google Cloud, we'll be acting as site 40.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
03:58.920 --> 04:02.480
And when we get their Google Cloud, we'll be acting as site 40.

72
04:02.480 --> 04:06.500
This way you can have multiple things configured at the same time if you desire

73
04:06.500 --> 04:06.600
.

74
04:06.600 --> 04:09.920
I tried to use non overlapping address space.

75
04:09.920 --> 04:16.560
But as you're being the 10.30.0.0/16, we are going to have to create this vnet.

76
04:16.560 --> 04:22.540
We're also going to be deploying this server one or SRV one into subnet 10,

77
04:22.540 --> 04:23.440
which is what

78
04:23.440 --> 04:27.560
we're going to make the 10.30.10.0/24.

79
04:27.560 --> 04:33.040
Now Azure does require another subnet for the VPN gateway.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
04:27.560 --> 04:33.040
Now Azure does require another subnet for the VPN gateway.

80
04:33.040 --> 04:37.310
That's not actually shown on this diagram, but there will be another subnet

81
04:37.310 --> 04:38.400
used exclusively

82
04:38.400 --> 04:40.600
for the VPN gateway.

83
04:40.600 --> 04:45.400
So once we get our Azure environment configured, we have our gateways deployed.

84
04:45.400 --> 04:52.110
Our main overall goal in this skill is going to be to build this native IP sec

85
04:52.110 --> 04:53.200
VPN tunnel

86
04:53.200 --> 05:00.560
from our on prem router one down to the VPN gateway in Microsoft Azure.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
04:53.200 --> 05:00.560
from our on prem router one down to the VPN gateway in Microsoft Azure.

87
05:00.560 --> 05:06.320
Now as we'll see as we go, Azure does provide two tunnels for redundancy when

88
05:06.320 --> 05:07.280
we deploy our

89
05:07.280 --> 05:08.800
VPN.

90
05:08.800 --> 05:15.880
To begin with, we will build that second IP sec tunnel also to on prem R1.

91
05:15.880 --> 05:20.570
However, what we're going to do during the challenge is we're actually going to

92
05:20.570 --> 05:21.080
move that

93
05:21.080 --> 05:27.880
second tunnel off of R1 and move it to on prem R2.

94
05:27.880 --> 05:30.400
So this will go into the same tunnel.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
05:27.880 --> 05:30.400
So this will go into the same tunnel.

95
05:30.400 --> 05:34.790
So then what we'll have is not only redundancy for the tunnel, but we'll also

96
05:34.790 --> 05:35.920
have redundancy

97
05:35.920 --> 05:40.560
for our edge devices in our on prem location.

98
05:40.560 --> 05:45.840
So overall, this is what we're going to be building throughout this skill.

99
05:45.840 --> 05:50.390
So in this video, we spent just a few minutes here putting together our game

100
05:50.390 --> 05:51.200
plan so we know

101
05:51.200 --> 05:54.960
what it is we're trying to accomplish as we move forward.

102
05:54.960 --> 06:00.010
So again, make sure that you have that on prem location deployed if necessary
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
05:54.960 --> 06:00.010
So again, make sure that you have that on prem location deployed if necessary

103
06:00.010 --> 06:00.840
create that

104
06:00.840 --> 06:06.250
resource group in Microsoft Azure other than that, we'll be building the rest

105
06:06.250 --> 06:06.840
of this

106
06:06.840 --> 06:08.280
throughout this skill.

107
06:08.280 --> 06:13.460
So again, that's going to include the vnet and subnet for our servers as well

108
06:13.460 --> 06:15.240
as our gateway,

109
06:15.240 --> 06:21.440
the server itself, and then of course the VPN between both on prem R1 and the

110
06:21.440 --> 06:22.440
gateway,

111
06:22.440 --> 06:27.440
and then of course in the challenge between on prem R2 and the gateway.

112
06:27.440 --> 06:31.910
So of course, the next thing we need to do is begin configuring our Azure
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
06:27.440 --> 06:31.910
So of course, the next thing we need to do is begin configuring our Azure

113
06:31.910 --> 06:33.040
environment.

114
06:33.040 --> 06:37.960
So let's begin by creating that vnet and that subnet in the next video.

115
06:37.960 --> 06:47.960
[BLANK_AUDIO]