WEBVTT

1
00:00.000 --> 00:07.400
So before we just jump in and start configuring things in either Google Cloud

2
00:07.400 --> 00:08.360
or our on-prem

3
00:08.360 --> 00:12.670
location, we need to have a game plan so we know exactly what it is we're going

4
00:12.670 --> 00:14.120
to accomplish.

5
00:14.120 --> 00:19.880
So to that end, let's bring up our topology diagram, talk about what's already

6
00:19.880 --> 00:20.600
built,

7
00:20.600 --> 00:24.350
or if it's not how to build it, and then we'll talk about what we're going to

8
00:24.350 --> 00:25.320
be accomplishing

9
00:25.320 --> 00:26.920
throughout this skill.

10
00:26.920 --> 00:33.260
So that said, let's go ahead and jump in and take a look at our topology
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:26.920 --> 00:33.260
So that said, let's go ahead and jump in and take a look at our topology

11
00:33.260 --> 00:34.400
diagram.

12
00:34.400 --> 00:39.880
So looking here at our diagram, let's start with the top section here.

13
00:39.880 --> 00:45.640
The top section of the diagram here represents the on-prem location, or we'll

14
00:45.640 --> 00:46.560
also refer

15
00:46.560 --> 00:49.600
to it as headquarters location.

16
00:49.600 --> 00:51.920
These are both going to be the same thing.

17
00:51.920 --> 00:56.260
Now if you've been following along in this course, we have used this topology a

18
00:56.260 --> 00:56.520
few

19
00:56.520 --> 01:00.680
times now as far as the on-prem location goes.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

19
00:56.520 --> 01:00.680
times now as far as the on-prem location goes.

20
01:00.680 --> 01:05.370
So one thing we need to be very careful of as we jump in here to this skill is

21
01:05.370 --> 01:05.720
we need

22
01:05.720 --> 01:11.320
to make sure that we have the baseline configuration on both R1 and R2.

23
01:11.320 --> 01:15.880
So if you're coming out of a different skill, please be sure to read baseline R

24
01:15.880 --> 01:18.000
1 and R2.

25
01:18.000 --> 01:22.850
If you don't have this environment built at all, also be aware that the files

26
01:22.850 --> 01:23.400
needed

27
01:23.400 --> 01:30.000
to configure this location are included below this video, including both the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
01:30.000 --> 01:31.600
Cisco CML version

29
01:31.600 --> 01:37.200
as well as the configurations needed for non-CML environments such as other

30
01:37.200 --> 01:38.360
router emulation

31
01:38.360 --> 01:40.240
software.

32
01:40.240 --> 01:43.750
Something else that we need to be aware of with our on-prem location,

33
01:43.750 --> 01:44.840
particularly when

34
01:44.840 --> 01:50.970
it comes to IPsec, is that we do have a pet device here that's doing network

35
01:50.970 --> 01:51.720
address

36
01:51.720 --> 01:56.520
translation between our internal network and the internet.

37
01:56.520 --> 02:00.850
Now this wouldn't necessarily always be the case, but in this environment we do
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:56.520 --> 02:00.850
Now this wouldn't necessarily always be the case, but in this environment we do

38
02:00.850 --> 02:01.320
have this

39
02:01.320 --> 02:02.880
pet device.

40
02:02.880 --> 02:07.940
In order to go through this pet device, we're going to be using something

41
02:07.940 --> 02:09.160
called NAT-T or

42
02:09.160 --> 02:11.320
NAT-Troversal.

43
02:11.320 --> 02:15.310
One of the ways that we'll see this evidenced as we go through our show

44
02:15.310 --> 02:16.440
commands later is

45
02:16.440 --> 02:24.760
that IPsec with NAT-Troversal will use port 4500 rather than port 500 as it's

46
02:24.760 --> 02:25.640
traversing

47
02:25.640 --> 02:27.240
the network.

48
02:27.240 --> 02:31.010
And there's one other thing that we're going to need to be aware of with this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
02:27.240 --> 02:31.010
And there's one other thing that we're going to need to be aware of with this

49
02:31.010 --> 02:32.560
NAT device.

50
02:32.560 --> 02:37.970
Like most other NAT devices, the whole purpose of this is to hide all of the

51
02:37.970 --> 02:39.200
traffic going

52
02:39.200 --> 02:46.210
to the internet behind a single IP address on the outside interface here of the

53
02:46.210 --> 02:47.480
pet device,

54
02:47.480 --> 02:53.510
meaning that from Google Cloud's perspective, any traffic coming back to this

55
02:53.510 --> 02:54.320
device is

56
02:54.320 --> 02:57.640
going to be going to this single address.

57
02:57.640 --> 03:03.490
And for other cloud providers such as AWS or Microsoft Azure, this hasn't
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:57.640 --> 03:03.490
And for other cloud providers such as AWS or Microsoft Azure, this hasn't

58
03:03.490 --> 03:04.520
really been

59
03:04.520 --> 03:05.520
a problem.

60
03:05.520 --> 03:11.480
And running multiple tunnels and redundant tunnels and so on without an issue.

61
03:11.480 --> 03:14.480
Google Cloud is going to be a little different.

62
03:14.480 --> 03:19.060
We'll see as we go through the configuration that Google Cloud expects a

63
03:19.060 --> 03:20.520
different destination

64
03:20.520 --> 03:24.120
address for each tunnel.

65
03:24.120 --> 03:29.330
Having only this single address here on our NAT device is going to be a problem

66
03:29.330 --> 03:30.360
, particularly
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
03:29.330 --> 03:30.360
, particularly

67
03:30.360 --> 03:35.280
when we get to our challenge, which is going to be to build a second tunnel.

68
03:35.280 --> 03:40.040
We'll talk more about that when we get there, but just be aware that this NAT

69
03:40.040 --> 03:40.920
issue is going

70
03:40.920 --> 03:45.320
to be a little bit of a bigger issue with Google Cloud.

71
03:45.320 --> 03:50.540
So on that note, let's talk about what is going on down here in our Google

72
03:50.540 --> 03:52.320
Cloud environment.

73
03:52.320 --> 03:56.410
Starting with the fact that right now the Google Cloud environment is

74
03:56.410 --> 03:57.840
essentially blank.

75
03:57.840 --> 04:03.660
Now I do have an existing project in my environment called SD when the reason
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
03:57.840 --> 04:03.660
Now I do have an existing project in my environment called SD when the reason

76
04:03.660 --> 04:04.680
it's called that

77
04:04.680 --> 04:08.680
is because I used that project for this entire course.

78
04:08.680 --> 04:15.850
And as such, I had to get certain quota limits increased to handle things like

79
04:15.850 --> 04:17.040
SD when and

80
04:17.040 --> 04:21.710
let's just say it was quite a battle to get those things accomplished with

81
04:21.710 --> 04:22.680
Google Cloud.

82
04:22.680 --> 04:26.890
And if I were to delete that project or change that project, I would lose those

83
04:26.890 --> 04:27.680
settings.

84
04:27.680 --> 04:32.520
So in my case, I'm going to be using that project called SD when, of course, if
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
04:27.680 --> 04:32.520
So in my case, I'm going to be using that project called SD when, of course, if

85
04:32.520 --> 04:33.040
you don't

86
04:33.040 --> 04:37.720
have a project already in Google Cloud, feel free to make your own.

87
04:37.720 --> 04:41.350
Now as we go through this, one of the main things we're going to have to do is

88
04:41.350 --> 04:41.840
we're going

89
04:41.840 --> 04:48.020
to have to create a VPC and a subnet to represent this network right here, the

90
04:48.020 --> 04:52.720
10.40.10.0/24.

91
04:52.720 --> 04:58.800
We're going to be considering this subnet 10 within our GCP environment.

92
04:58.800 --> 05:07.750
After all, Google Cloud is going to be responsible for the 10.40.0.0/16 network
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
04:58.800 --> 05:07.750
After all, Google Cloud is going to be responsible for the 10.40.0.0/16 network

93
05:07.750 --> 05:09.720
in our environment.

94
05:09.720 --> 05:13.590
Now really you could use any address and you want here, but what I'm trying to

95
05:13.590 --> 05:14.120
do throughout

96
05:14.120 --> 05:21.520
the course is keep AWS, Microsoft Azure, and here, of course, Google Cloud on

97
05:21.520 --> 05:22.120
separate

98
05:22.120 --> 05:23.680
address spaces.

99
05:23.680 --> 05:27.660
So if you did want to get all of these up and running at the same time, you

100
05:27.660 --> 05:28.560
could without

101
05:28.560 --> 05:30.880
having any overlap.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
05:28.560 --> 05:30.880
having any overlap.

102
05:30.880 --> 05:33.820
Of course, one of the other things that we're going to be doing is we're going

103
05:33.820 --> 05:34.560
to be deploying

104
05:34.560 --> 05:40.440
this SRV1 here or server one to be acting as a target.

105
05:40.440 --> 05:45.020
Our end goal in this whole thing is going to be to have workstation one up here

106
05:45.020 --> 05:45.520
in the

107
05:45.520 --> 05:53.000
on-prem location, be able to talk to SRV1 down here in Google Cloud.

108
05:53.000 --> 05:56.250
And of course, if you couldn't tell from the title of the skill, the way we're

109
05:56.250 --> 05:56.640
going to be

110
05:56.640 --> 06:02.650
doing this is we're going to be building an IP Sec Tunnel from on-prem R1 down
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
05:56.640 --> 06:02.650
doing this is we're going to be building an IP Sec Tunnel from on-prem R1 down

111
06:02.650 --> 06:03.600
here to

112
06:03.600 --> 06:07.640
the Google gateway for our VPN.

113
06:07.640 --> 06:12.240
Ultimately, we're going to be building a second tunnel in our challenge.

114
06:12.240 --> 06:17.280
And as I sort of already implied, this one's going to be going to on-prem R2.

115
06:17.280 --> 06:22.170
So this is going to take a little bit of manipulation with our NAT tables and

116
06:22.170 --> 06:24.520
how we deploy our environment.

117
06:24.520 --> 06:29.000
Again, we'll talk about that a little bit more when we get to the challenge.

118
06:29.000 --> 06:31.760
But overall, this is our goal.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

118
06:29.000 --> 06:31.760
But overall, this is our goal.

119
06:31.760 --> 06:37.700
We need to configure Google Cloud to not only have our VPC, our subnet, and our

120
06:37.700 --> 06:38.280
server,

121
06:38.280 --> 06:45.650
but then of course, also to have this VPN configured to on-prem R1 and on-prem

122
06:45.650 --> 06:46.440
R2 in the

123
06:46.440 --> 06:48.160
challenge.

124
06:48.160 --> 06:52.880
So in this video, we just jumped into our topology diagram here to put together

125
06:52.880 --> 06:53.960
a game plan of what

126
06:53.960 --> 06:57.920
we're trying to accomplish throughout the rest of this skill.

127
06:57.920 --> 07:03.870
One thing very important to keep in mind is that our on-prem location is hidden
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
06:57.920 --> 07:03.870
One thing very important to keep in mind is that our on-prem location is hidden

128
07:03.870 --> 07:04.400
behind

129
07:04.400 --> 07:10.840
a NAT/PET device that's hiding everything behind a single IP address.

130
07:10.840 --> 07:14.120
As we get to our challenge, that's going to become a problem.

131
07:14.120 --> 07:19.400
And I just want to point out that in your environment, if you have more than

132
07:19.400 --> 07:21.200
one external IP address

133
07:21.200 --> 07:25.680
available, then that's going to be the easiest way to configure this.

134
07:25.680 --> 07:29.670
In my case, I don't have that available, so we're going to bend the rules just

135
07:29.670 --> 07:30.220
a little
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

135
07:29.670 --> 07:30.220
a little

136
07:30.220 --> 07:33.600
bit just to get it working so you can see it function.

137
07:33.600 --> 07:38.090
The most ideal situation though, of course, would be to have two outside

138
07:38.090 --> 07:39.240
addresses on your

139
07:39.240 --> 07:44.040
NAT or PET device and then just use that for the second tunnel.

140
07:44.040 --> 07:47.850
This will, of course, make more sense as we go through the rest of this skill

141
07:47.850 --> 07:48.460
and we see

142
07:48.460 --> 07:51.640
how this gets configured on Google Cloud.

143
07:51.640 --> 07:55.980
So that said, let's go ahead and jump into the Google Cloud console and get

144
07:55.980 --> 07:56.600
started with

145
07:56.600 --> 08:00.120
our configuration of our VPC and our subnet.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

145
07:56.600 --> 08:00.120
our configuration of our VPC and our subnet.

146
08:00.120 --> 08:10.120
[BLANK_AUDIO]