WEBVTT

1
00:00.000 --> 00:07.280
So in this section, we're going to be looking to accomplish two things.

2
00:07.280 --> 00:13.160
The first is we want to configure our routing appropriately in Google Cloud.

3
00:13.160 --> 00:19.380
We need to configure a default route in Subnet 10 so that all of the traffic

4
00:19.380 --> 00:20.840
goes to GCPR

5
00:20.840 --> 00:24.880
1 rather than the default Google Internet gateway.

6
00:24.880 --> 00:32.750
We also want to configure Subnet 1 so that internal traffic in the 10.0.0.0/8
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

6
00:24.880 --> 00:32.750
We also want to configure Subnet 1 so that internal traffic in the 10.0.0.0/8

7
00:32.750 --> 00:34.240
network are also

8
00:34.240 --> 00:40.000
sent to GCPR 1 to be able to get to the inside network.

9
00:40.000 --> 00:44.900
Once the routing is set up, the next thing we want to do of course is make sure

10
00:44.900 --> 00:45.760
that Subnet

11
00:45.760 --> 00:52.920
10 can actually get out to the Internet, specifically gigabit 2 on GCPR 1.

12
00:52.920 --> 00:59.370
So let's jump in to the Google Cloud dashboard and start by configuring that

13
00:59.370 --> 01:00.480
routing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:59.370 --> 01:00.480
routing.

14
01:00.480 --> 01:05.960
So from here on the dashboard, where we want to go is over here to VPC network

15
01:05.960 --> 01:06.120
and we

16
01:06.120 --> 01:11.320
can either click right here or we can come out to this pop out menu and go to

17
01:11.320 --> 01:11.640
routes.

18
01:11.640 --> 01:16.000
Either way we can get to the routes section and then what we want to do is

19
01:16.000 --> 01:16.920
click on route

20
01:16.920 --> 01:19.000
management up here.

21
01:19.000 --> 01:23.240
After route management, we're going to want to create a route.

22
01:23.240 --> 01:25.160
First we need to give it a name.

23
01:25.160 --> 01:32.740
Let's go ahead and create the one for Subnet 1 inside traffic first.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
01:25.160 --> 01:32.740
Let's go ahead and create the one for Subnet 1 inside traffic first.

24
01:32.740 --> 01:35.600
You can of course give this a description if you want.

25
01:35.600 --> 01:37.200
We do need to choose the network.

26
01:37.200 --> 01:41.080
Now we just said this is for Subnet 1 so that would be VPC 1.

27
01:41.080 --> 01:44.520
It is going to be a static route for IPv4.

28
01:44.520 --> 01:48.480
The destination is going to be the internal addresses.

29
01:48.480 --> 01:52.320
So it's going to be 10.0.0.0/8.

30
01:52.320 --> 01:57.520
For the priority, the default routes that Google puts in are all a priority of

31
01:57.520 --> 01:58.760
1000.

32
01:58.760 --> 02:02.980
We want to make sure that our routes win because we're putting them in here on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

32
01:58.760 --> 02:02.980
We want to make sure that our routes win because we're putting them in here on

33
02:02.980 --> 02:03.760
purpose.

34
02:03.760 --> 02:09.490
So I usually just drop this down to 100 and then for the next hop, we want to

35
02:09.490 --> 02:11.000
change this

36
02:11.000 --> 02:17.110
to be a specific instance and for the instance, we're going to point it to GCPR

37
02:17.110 --> 02:17.760
1.

38
02:17.760 --> 02:22.280
Once all of this is done, we'll go ahead and hit create.

39
02:22.280 --> 02:25.120
Once that's successful, we'll make our second route.

40
02:25.120 --> 02:27.640
So we'll say create route again.

41
02:27.640 --> 02:32.800
This one is going to be Subnet 10 default.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
02:27.640 --> 02:32.800
This one is going to be Subnet 10 default.

42
02:32.800 --> 02:36.160
This of course is going to be for VPC 10 now.

43
02:36.160 --> 02:39.320
Destination range is going to be the default.

44
02:39.320 --> 02:43.000
Priority again, we'll set it to 100 and instead of going to the default and

45
02:43.000 --> 02:44.840
then at Gateway,

46
02:44.840 --> 02:46.960
we're going to point it to an instance.

47
02:46.960 --> 02:50.400
And again, we're going to point it to R1.

48
02:50.400 --> 02:54.910
Just a quick note, by the way, on the next hop, there is a choice to do a

49
02:54.910 --> 02:56.240
specific IP address

50
02:56.240 --> 02:57.720
of an instance.

51
02:57.720 --> 03:01.390
The downside to that is if it's address were to change at any point, you would
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
02:57.720 --> 03:01.390
The downside to that is if it's address were to change at any point, you would

52
03:01.390 --> 03:02.040
have to come

53
03:02.040 --> 03:05.720
update this by pointing it directly to the instance.

54
03:05.720 --> 03:09.680
GCP will keep that information updated on its own.

55
03:09.680 --> 03:13.420
So generally speaking, I prefer to point it to an instance rather than an

56
03:13.420 --> 03:14.120
address.

57
03:14.120 --> 03:16.440
We'll go ahead and hit create.

58
03:16.440 --> 03:21.940
So with these routes in place, let's make sure that SRV1 and jumpbox1 can

59
03:21.940 --> 03:23.140
communicate to

60
03:23.140 --> 03:27.140
each other through the catalyst 8,000 V now.

61
03:27.140 --> 03:29.560
So let's go back to our VMs.

62
03:29.560 --> 03:32.720
On SRV1, we'll SSH into it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
03:29.560 --> 03:32.720
On SRV1, we'll SSH into it.

63
03:32.720 --> 03:35.400
From here, we'll try to ping the jumpbox.

64
03:35.400 --> 03:39.330
We see that that's successful, but do we know that it's going the right

65
03:39.330 --> 03:40.240
direction?

66
03:40.240 --> 03:42.720
The answer to that is no.

67
03:42.720 --> 03:47.100
So let's do a trace route minus N so we don't do name resolution and go again

68
03:47.100 --> 03:50.360
to 10.40.1.10.

69
03:50.360 --> 03:54.370
Now what we're seeing here is we're actually only getting the first hop because

70
03:54.370 --> 03:54.840
of the rest

71
03:54.840 --> 03:57.840
of the devices are not responding to the trace.

72
03:57.840 --> 03:58.880
That's okay.

73
03:58.880 --> 04:02.600
All we're looking for is to make sure that A, it's working, which the ping
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
03:58.880 --> 04:02.600
All we're looking for is to make sure that A, it's working, which the ping

74
04:02.600 --> 04:03.320
tells us that

75
04:03.320 --> 04:11.250
it is and that it's actually going to the catalyst 8,000 V, which we know is .2

76
04:11.250 --> 04:11.600
on that

77
04:11.600 --> 04:12.680
subnet.

78
04:12.680 --> 04:14.680
So this is working correctly.

79
04:14.680 --> 04:20.210
However, if we were to try to ping the internet, notice that this is not

80
04:20.210 --> 04:21.520
functional.

81
04:21.520 --> 04:24.120
So let's see if we can take a look at why.

82
04:24.120 --> 04:27.000
Let's jump over to GCPR1.

83
04:27.000 --> 04:31.600
So here on GCPR1, we already know that we can ping the internet.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
04:27.000 --> 04:31.600
So here on GCPR1, we already know that we can ping the internet.

84
04:31.600 --> 04:33.480
We did this previously.

85
04:33.480 --> 04:38.390
However, if we try to source it from the gigabit 2 interface, which is the

86
04:38.390 --> 04:39.360
inside interface

87
04:39.360 --> 04:44.940
with the interface on subnet 10, notice that that's not working from here

88
04:44.940 --> 04:45.280
either.

89
04:45.280 --> 04:48.320
Now there's a very simple reason for this.

90
04:48.320 --> 04:52.880
Remember the GCPR1, if we do a show IP route?

91
04:52.880 --> 04:59.480
Remember that it's default gateway is pointing to the Google default internet

92
04:59.480 --> 05:00.400
gateway and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
04:59.480 --> 05:00.400
gateway and

93
05:00.400 --> 05:05.830
the Google internet gateway will only handle traffic for the connected network,

94
05:05.830 --> 05:06.200
being the

95
05:06.200 --> 05:09.960
10.40.1.0/24.

96
05:09.960 --> 05:17.530
So essentially we need to make the inside network, the 10.40.10.0 look like it

97
05:17.530 --> 05:18.760
's coming from

98
05:18.760 --> 05:23.160
this router's address, the 10.40.1.2.

99
05:23.160 --> 05:28.720
So to do this, of course, all we have to do is configure NAT here on router 1

100
05:28.720 --> 05:29.400
to hide

101
05:29.400 --> 05:34.040
the inside addresses behind its gigabit 1 interface.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
05:29.400 --> 05:34.040
the inside addresses behind its gigabit 1 interface.

102
05:34.040 --> 05:36.600
So for this, we'll simply configure NAT.

103
05:36.600 --> 05:41.680
So we make an ACL matching the inside interface, put in our IP NAT inside

104
05:41.680 --> 05:43.840
source list to overload

105
05:43.840 --> 05:48.160
that access list on the outside interface.

106
05:48.160 --> 05:54.000
The other thing we have to do is specify interface gigabit 2 as IP NAT inside.

107
05:54.000 --> 05:59.040
Now normally you would have to configure gigabit 1 as IP NAT outside.

108
05:59.040 --> 06:03.970
However, if we do a show run interface gigabit 1, part of the default can be
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
05:59.040 --> 06:03.970
However, if we do a show run interface gigabit 1, part of the default can be

109
06:03.970 --> 06:04.000
called the

110
06:04.000 --> 06:10.230
configuration that Cisco puts on here in Google Cloud is the IP NAT outside is

111
06:10.230 --> 06:12.120
already here.

112
06:12.120 --> 06:17.720
So with all of that configured, we should be able to do our ping from gigabit 2

113
06:17.720 --> 06:18.240
again

114
06:18.240 --> 06:20.640
and it should now function.

115
06:20.640 --> 06:25.040
We can verify this by doing a show IP NAT translation.

116
06:25.040 --> 06:29.490
And what we see is it has already done some IP NAT translations specifically

117
06:29.490 --> 06:30.240
for traffic
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
06:29.490 --> 06:30.240
for traffic

118
06:30.240 --> 06:32.920
going to the outside network.

119
06:32.920 --> 06:39.080
So specifically we see here that the inside local address, meaning it's gigabit

120
06:39.080 --> 06:40.160
2 interface,

121
06:40.160 --> 06:46.880
the inside private address of 10.40.10.2 has been hidden behind the outside

122
06:46.880 --> 06:47.720
address, which

123
06:47.720 --> 06:51.320
is actually the inside global address.

124
06:51.320 --> 06:55.880
That's just how Cisco refers to it, the 10.40.1.2.

125
06:55.880 --> 07:01.460
So we see here that it's doing that properly, which means if we go back over to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

125
06:55.880 --> 07:01.460
So we see here that it's doing that properly, which means if we go back over to

126
07:01.460 --> 07:02.160
SRV1,

127
07:02.160 --> 07:08.070
we can actually see here that while we were away talking, it's ping has already

128
07:08.070 --> 07:08.520
started

129
07:08.520 --> 07:09.520
working.

130
07:09.520 --> 07:13.600
So now we have reachability from subnet 10.

131
07:13.600 --> 07:17.770
So we can actually break out of this and make sure that we can actually get to

132
07:17.770 --> 07:18.280
say,

133
07:18.280 --> 07:20.760
for example, Cisco as well.

134
07:20.760 --> 07:22.720
We see here that we can.

135
07:22.720 --> 07:28.830
So this means we now have full reachability from our SRV1 out to not only the

136
07:28.830 --> 07:29.720
jump box,

137
07:29.720 --> 07:34.080
which we're using of course just for some local verification, but also all the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

137
07:29.720 --> 07:34.080
which we're using of course just for some local verification, but also all the

138
07:34.080 --> 07:34.680
way out to

139
07:34.680 --> 07:40.520
the internet with name resolution going through NAT on GCP R1.

140
07:40.520 --> 07:44.400
So everything is working as we intended.

141
07:44.400 --> 07:49.420
So in this video, we configured the routing that we needed to within the Google

142
07:49.420 --> 07:49.880
Cloud

143
07:49.880 --> 07:51.440
environment.

144
07:51.440 --> 07:57.800
Then we verified reachability between SRV1 and the jump box.

145
07:57.800 --> 08:02.030
And of course, when we tested going out to the internet, it wasn't functioning
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

145
07:57.800 --> 08:02.030
And of course, when we tested going out to the internet, it wasn't functioning

146
08:02.030 --> 08:02.320
because

147
08:02.320 --> 08:06.560
of the way that the Google internet gateway handles traffic.

148
08:06.560 --> 08:10.000
It only handles traffic for the directly connected network.

149
08:10.000 --> 08:17.190
So then we had to configure GCP R1 to do NAT hiding everything on subnet 10

150
08:17.190 --> 08:18.920
behind GCP R1's

151
08:18.920 --> 08:21.800
address on subnet 1.

152
08:21.800 --> 08:26.870
As soon as we did that, we now have full reachability from SRV1 all the way out

153
08:26.870 --> 08:28.560
to the internet and

154
08:28.560 --> 08:31.800
from GCP R1 out to the internet.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

154
08:28.560 --> 08:31.800
from GCP R1 out to the internet.

155
08:31.800 --> 08:35.240
And those were our goals for this skill.

156
08:35.240 --> 08:39.380
So that means that we've covered everything we need to in this skill, except

157
08:39.380 --> 08:41.080
for the challenge.

158
08:41.080 --> 08:46.460
In this challenge, we're going to have you deploy a redundant router into GCP,

159
08:46.460 --> 08:47.040
specifically

160
08:47.040 --> 08:48.880
GCP R2.

161
08:48.880 --> 08:52.800
So go ahead and give that a shot, and I'll see you in the solution video on the

162
08:52.800 --> 08:53.640
other side.

163
08:53.640 --> 08:56.640
(mouse clicking)