WEBVTT

1
00:00.000 --> 00:09.080
So our final step in getting all of this working is to configure a service VPN

2
00:09.080 --> 00:10.840
for VLAN 10.

3
00:10.840 --> 00:14.720
Now this is going to be very, very similar to the ones we've already done.

4
00:14.720 --> 00:17.440
It will have a few more interfaces in it.

5
00:17.440 --> 00:22.880
We're going to bring, for example, a loopback interface into OSPF and on the

6
00:22.880 --> 00:24.600
service side,

7
00:24.600 --> 00:30.300
moving towards the clients, we're also going to run VRRP, which means that the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

7
00:24.600 --> 00:30.300
moving towards the clients, we're also going to run VRRP, which means that the

8
00:30.300 --> 00:31.680
inside addresses

9
00:31.680 --> 00:34.840
on our routers are going to be a little bit different.

10
00:34.840 --> 00:41.560
So let's go ahead and jump in and configure our service VPN for VLAN 10.

11
00:41.560 --> 00:46.240
So this time we'll just start off already editing our template.

12
00:46.240 --> 00:50.030
What we're going to do is we're going to jump down to the service VPN section

13
00:50.030 --> 00:50.440
and we're

14
00:50.440 --> 00:53.320
going to add a VPN.

15
00:53.320 --> 00:59.060
Now, as you can see here, Cisco does provide some default templates for VPNs,

16
00:59.060 --> 00:59.560
but we're

17
00:59.560 --> 01:03.360
just going to go ahead and create a VPN template.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

17
00:59.560 --> 01:03.360
just going to go ahead and create a VPN template.

18
01:03.360 --> 01:05.440
This is going to be for VLAN 10.

19
01:05.440 --> 01:08.080
So we'll call this VPN 10.

20
01:08.080 --> 01:11.920
We'll do the same thing we've done with our descriptions so far.

21
01:11.920 --> 01:15.280
And our VPN number, we're going to have to change this time.

22
01:15.280 --> 01:17.480
This is going to be 10.

23
01:17.480 --> 01:22.320
Since this is going to be used for internet access, it's also going to need an

24
01:22.320 --> 01:22.880
IPV for

25
01:22.880 --> 01:23.880
route.

26
01:23.880 --> 01:25.960
So we'll jump down to that section.

27
01:25.960 --> 01:28.040
We will add a new route.

28
01:28.040 --> 01:32.790
Once again, this is going to be a default pointing to a next hop in my
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
01:28.040 --> 01:32.790
Once again, this is going to be a default pointing to a next hop in my

29
01:32.790 --> 01:34.040
environment.

30
01:34.040 --> 01:38.680
The next hop is 204 dot 186 dot 19 dot one.

31
01:38.680 --> 01:43.260
We'll simply hit add and then we'll add the default route.

32
01:43.260 --> 01:46.560
That's all we need to configure in the VPN itself.

33
01:46.560 --> 01:48.360
So we'll hit save.

34
01:48.360 --> 01:54.840
We'll select the VPN we just created and we'll add it to our service VPN.

35
01:54.840 --> 01:56.440
We'll hit next.

36
01:56.440 --> 01:59.520
Now we need to start adding our additional templates.

37
01:59.520 --> 02:02.050
So the first thing we're going to want is we already said we're going to run
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:59.520 --> 02:02.050
So the first thing we're going to want is we already said we're going to run

38
02:02.050 --> 02:03.240
Cisco OSPF.

39
02:03.240 --> 02:05.000
So let's add that.

40
02:05.000 --> 02:07.080
We're going to create a new template.

41
02:07.080 --> 02:11.080
Again, we don't want to use the one we used for VPN zero.

42
02:11.080 --> 02:21.360
So this template name will be OSPF VPN 10, the description OSPF for VPN 10.

43
02:21.360 --> 02:26.880
And then we'll jump down to the area configuration and we'll add a new area.

44
02:26.880 --> 02:30.240
Now once again, we're just going to configure area zero here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
02:26.880 --> 02:30.240
Now once again, we're just going to configure area zero here.

45
02:30.240 --> 02:34.640
We'll be using the normal area type, but we do need to add interfaces.

46
02:34.640 --> 02:36.800
So we'll hit add interface.

47
02:36.800 --> 02:44.520
The first interface we're going to add gigabit ethernet 2.10.

48
02:44.520 --> 02:49.080
And just like we did for our other interface, let's change the default hello

49
02:49.080 --> 02:49.760
timer to be

50
02:49.760 --> 02:58.800
one and the dead interval to be four and under advanced, we'll set the network

51
02:58.800 --> 02:58.960
type to be

52
02:58.960 --> 03:00.760
point to point.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
02:58.960 --> 03:00.760
point to point.

53
03:00.760 --> 03:03.760
Now we're not just going to hit add at this point because it would just add

54
03:03.760 --> 03:05.600
this one interface.

55
03:05.600 --> 03:08.960
We're going to hit add interface over here on the left.

56
03:08.960 --> 03:13.440
And now we're going to add loop back zero.

57
03:13.440 --> 03:18.890
And for this one under advanced, we're going to change this globally to be a

58
03:18.890 --> 03:20.640
passive interface.

59
03:20.640 --> 03:25.480
So this is going to add these two interfaces to the OSPF process.

60
03:25.480 --> 03:31.280
So now we'll hit add and now under interface, we have two interfaces.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
03:25.480 --> 03:31.280
So now we'll hit add and now under interface, we have two interfaces.

61
03:31.280 --> 03:35.720
So we'll add that area and then we'll hit save.

62
03:35.720 --> 03:38.720
The next thing we want to do is start adding our interfaces.

63
03:38.720 --> 03:42.760
So we'll add a Cisco VPN interface ethernet.

64
03:42.760 --> 03:49.240
We'll create a new template for this template name, gigabit ethernet 2.10 for

65
03:49.240 --> 03:51.520
the description,

66
03:51.520 --> 03:55.960
GE 2.10 configuration.

67
03:55.960 --> 04:03.060
Of course, we need to bring the interface up so globally, no shutdown interface
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
03:55.960 --> 04:03.060
Of course, we need to bring the interface up so globally, no shutdown interface

68
04:03.060 --> 04:03.080
name,

69
04:03.080 --> 04:07.720
gigabit ethernet 2.10 description.

70
04:07.720 --> 04:10.840
We'll just call it the VLAN 10 interface.

71
04:10.840 --> 04:13.400
Let's scroll down to our IP address.

72
04:13.400 --> 04:15.640
We'll set this to device specific.

73
04:15.640 --> 04:18.320
Again, we'll change our key.

74
04:18.320 --> 04:22.240
This is going to be gigabit 2.10.

75
04:22.240 --> 04:29.600
Now remember we said that on this service side for VPN 10, we want to run VRRP.

76
04:29.600 --> 04:32.400
So let's scroll down a bit more.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

76
04:29.600 --> 04:32.400
So let's scroll down a bit more.

77
04:32.400 --> 04:37.720
And here under the VRRP section, we'll say new VRRP.

78
04:37.720 --> 04:42.960
We'll simply set the group ID to be 10 because it's VLAN 10.

79
04:42.960 --> 04:47.700
And for the IP address, we'll set this globally since this is the shared

80
04:47.700 --> 04:48.560
address.

81
04:48.560 --> 04:52.200
This is going to be 10 dot 10 dot 10 dot one.

82
04:52.200 --> 04:57.360
Let's go ahead and add this VRRP instance so we can see that this has been

83
04:57.360 --> 04:59.200
added successfully.

84
04:59.200 --> 05:03.440
This is everything we need to configure for the VLAN 10 interface.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
04:59.200 --> 05:03.440
This is everything we need to configure for the VLAN 10 interface.

85
05:03.440 --> 05:05.560
So let's hit save.

86
05:05.560 --> 05:09.440
Then we're going to need another Cisco VPN interface ethernet.

87
05:09.440 --> 05:11.720
This is going to be for gigabit one.

88
05:11.720 --> 05:14.080
So again, we'll create a template.

89
05:14.080 --> 05:22.120
We'll call this gigabit ethernet one for the description GE 1 configuration.

90
05:22.120 --> 05:28.430
We'll do our no shut the interface name gigabit ethernet one for the

91
05:28.430 --> 05:30.120
description.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
05:28.430 --> 05:30.120
description.

92
05:30.120 --> 05:34.120
We'll simply say outside interface for the IPV for address.

93
05:34.120 --> 05:40.330
Again, it's going to be device specific and for the interface, this is gigabit

94
05:40.330 --> 05:41.000
one.

95
05:41.000 --> 05:43.680
That's all we need to add for this interface.

96
05:43.680 --> 05:49.710
So let's hit save and we need to add one more, which of course is the loop back

97
05:49.710 --> 05:50.760
interface.

98
05:50.760 --> 05:54.360
So on the drop down, we'll create a new template.

99
05:54.360 --> 05:58.920
We'll simply call this loop back zero for the description.

100
05:58.920 --> 06:01.160
We'll set it to loop back zero configuration.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
05:58.920 --> 06:01.160
We'll set it to loop back zero configuration.

101
06:01.160 --> 06:04.960
We'll of course configure it to come up for the interface.

102
06:04.960 --> 06:11.120
It's loop back zero for the description loop back zero interface.

103
06:11.120 --> 06:14.040
Once again, we want a static address on this.

104
06:14.040 --> 06:16.440
So we'll set it to device specific.

105
06:16.440 --> 06:20.680
We'll change our key to loop back zero.

106
06:20.680 --> 06:24.320
Everything else again defaults, so we'll hit save.

107
06:24.320 --> 06:29.680
So this takes care of configuring OSPF, our gigabit two dot 10 interface,

108
06:29.680 --> 06:29.960
including the

109
06:29.960 --> 06:37.080
configuration of VRRP, then our gigabit one and our loop back zero interfaces.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
06:29.960 --> 06:37.080
configuration of VRRP, then our gigabit one and our loop back zero interfaces.

110
06:37.080 --> 06:40.200
So once this is all done, we hit add.

111
06:40.200 --> 06:46.320
We see here it's added the VPN 10 template to our service VPN section.

112
06:46.320 --> 06:49.940
So now we update our device template.

113
06:49.940 --> 06:54.270
We see here that again, we have the gray X's because we have new fields we need

114
06:54.270 --> 06:54.640
to fill

115
06:54.640 --> 06:55.880
in.

116
06:55.880 --> 07:00.760
So if we come up here, notice this first one is the loop back zero interface.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
06:55.880 --> 07:00.760
So if we come up here, notice this first one is the loop back zero interface.

117
07:00.760 --> 07:07.610
So in the case of router one, this is going to be 10 dot 100 dot one dot one

118
07:07.610 --> 07:08.920
slash 32.

119
07:08.920 --> 07:15.040
In the case of router two, it's 10 dot 100 dot one dot two slash 32.

120
07:15.040 --> 07:21.030
For the gigabit one interface, it's two, four dot one eight six dot 19 dot 10

121
07:21.030 --> 07:23.380
slash 24 and

122
07:23.380 --> 07:30.340
two, four dot one eight six dot 19 dot 20 slash 24.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
07:23.380 --> 07:30.340
two, four dot one eight six dot 19 dot 20 slash 24.

123
07:30.340 --> 07:35.380
The next field is the gigabit two dot 10 IPV four address.

124
07:35.380 --> 07:37.620
Now here we have to be a little bit careful.

125
07:37.620 --> 07:42.230
This is going to be 10 dot 10 dot 10 dot, but we can't do our traditional dot

126
07:42.230 --> 07:42.740
one and

127
07:42.740 --> 07:48.000
dot two because we're putting VRRP at the dot one.

128
07:48.000 --> 07:56.070
So we're actually going to make router one, the dot two here slash 24 and

129
07:56.070 --> 07:57.920
router two at

130
07:57.920 --> 07:59.620
dot three.

131
07:59.620 --> 08:03.340
So now that we've filled in our new variable fields, of course, all of the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
07:59.620 --> 08:03.340
So now that we've filled in our new variable fields, of course, all of the

132
08:03.340 --> 08:04.120
other ones are

133
08:04.120 --> 08:05.320
still here.

134
08:05.320 --> 08:09.520
If we scroll over, they're just already filled out from the last time we

135
08:09.520 --> 08:11.180
deployed this template.

136
08:11.180 --> 08:15.100
It, of course, remembers all of these previous values.

137
08:15.100 --> 08:17.620
So now we can simply deploy this.

138
08:17.620 --> 08:19.060
We'll hit next.

139
08:19.060 --> 08:22.360
We could review the configuration here if we wanted to.

140
08:22.360 --> 08:28.140
We'll just hit configure devices, confirm the change, hit okay, and it will

141
08:28.140 --> 08:28.940
begin the

142
08:28.940 --> 08:30.500
deployment.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
08:28.940 --> 08:30.500
deployment.

143
08:30.500 --> 08:34.860
So now that our template has been successfully pushed to both devices, let's

144
08:34.860 --> 08:35.700
just jump over

145
08:35.700 --> 08:40.340
to the command line and verify that these changes have taken effect.

146
08:40.340 --> 08:44.940
So the first thing we want to do is simply a show VRF.

147
08:44.940 --> 08:52.380
Notice how for the service VPN, it actually names the VRF after the VPN.

148
08:52.380 --> 08:54.860
So now we have a VRF 10.

149
08:54.860 --> 09:01.240
So like we did before, let's set our routing context to VRF 10 so that we can
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
08:54.860 --> 09:01.240
So like we did before, let's set our routing context to VRF 10 so that we can

150
09:01.240 --> 09:02.460
do everything

151
09:02.460 --> 09:04.900
from inside the service VPN.

152
09:04.900 --> 09:08.700
First, let's verify our routing protocol.

153
09:08.700 --> 09:11.020
Let's do a show IPOS PF neighbor.

154
09:11.020 --> 09:15.580
We see that we do have an adjacency with router two.

155
09:15.580 --> 09:21.020
Remember that router to's address is 10 dot 10 dot 10 dot three.

156
09:21.020 --> 09:23.780
And it is out the correct interface.

157
09:23.780 --> 09:26.580
We do a show IPOS PF interface brief.

158
09:26.580 --> 09:31.800
We see that we are in fact running OSPF on our loop back zero and our gigabit
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

158
09:26.580 --> 09:31.800
We see that we are in fact running OSPF on our loop back zero and our gigabit

159
09:31.800 --> 09:32.460
two dot

160
09:32.460 --> 09:35.660
10 interface as we're supposed to.

161
09:35.660 --> 09:41.600
If we do a show IP route, we see here that we have an OSPF route to 10 dot 100

162
09:41.600 --> 09:42.020
dot one

163
09:42.020 --> 09:47.100
dot two, which is router to's loop back interface.

164
09:47.100 --> 09:51.290
Now that's the only OSPF route we have because at the moment, everything else

165
09:51.290 --> 09:52.340
is of course,

166
09:52.340 --> 09:57.990
either local or connected to router one, a side of course from our static

167
09:57.990 --> 09:58.860
default here

168
09:58.860 --> 10:02.520
at the top pointing to our default gateway.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

168
09:58.860 --> 10:02.520
at the top pointing to our default gateway.

169
10:02.520 --> 10:06.390
And since we have that, we should also be able to ping eight dot eight dot

170
10:06.390 --> 10:07.540
eight dot eight

171
10:07.540 --> 10:09.440
out to the internet.

172
10:09.440 --> 10:15.600
And of course, one last thing we configured if we say show VRRP notice that out

173
10:15.600 --> 10:16.100
of our

174
10:16.100 --> 10:20.560
gigabit two dot 10 interface, we have our group 10.

175
10:20.560 --> 10:24.280
We see that currently router one here is the master.

176
10:24.280 --> 10:29.310
We see the virtual IP address that we sat and we see that its current priority

177
10:29.310 --> 10:30.140
is 100.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

177
10:29.310 --> 10:30.140
is 100.

178
10:30.140 --> 10:34.180
Now we've pretty much seen everything's working here on router one, but let's

179
10:34.180 --> 10:34.980
hop into router

180
10:34.980 --> 10:35.980
two quick.

181
10:35.980 --> 10:42.980
We'll just go right into our routing context and let's just verify the routing

182
10:42.980 --> 10:43.300
table.

183
10:43.300 --> 10:44.300
This looks correct.

184
10:44.300 --> 10:46.140
It has its static default.

185
10:46.140 --> 10:51.060
We see that it's got an OSPF route to router ones loop back.

186
10:51.060 --> 10:53.180
It can reach the internet.

187
10:53.180 --> 10:59.300
And if we do our show VRRP, we see that router two here is the backup.

188
10:59.300 --> 11:04.200
One last thing to verify, we need to make sure that our workstation, which is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

188
10:59.300 --> 11:04.200
One last thing to verify, we need to make sure that our workstation, which is

189
11:04.200 --> 11:04.740
on VLAN

190
11:04.740 --> 11:10.140
10, can go through VRRP and get routed out to the internet.

191
11:10.140 --> 11:13.820
So let's jump into the console of workstation one.

192
11:13.820 --> 11:17.750
First, if we look at the route, I just want to show you that it is using the

193
11:17.750 --> 11:18.740
gateway of

194
11:18.740 --> 11:21.500
10 dot 10 dot 10 dot one.

195
11:21.500 --> 11:25.420
So now let's make sure that we can ping out to the internet.

196
11:25.420 --> 11:27.940
We can see here that it can.

197
11:27.940 --> 11:32.580
Let's also trace out to the internet so we can see the path that it's following
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

197
11:27.940 --> 11:32.580
Let's also trace out to the internet so we can see the path that it's following

198
11:32.580 --> 11:32.580
.

199
11:32.580 --> 11:35.340
I'm just going to exit out of the trace.

200
11:35.340 --> 11:40.190
Ultimately, there are some devices in the path to Google that will not respond

201
11:40.190 --> 11:40.660
to the

202
11:40.660 --> 11:43.340
trace and it will just time out and so on.

203
11:43.340 --> 11:47.100
What we care about here is just the first couple hops.

204
11:47.100 --> 11:53.570
Notice that it's going to 10 dot 10 dot 10 dot two, which as we just saw is the

205
11:53.570 --> 11:54.180
master

206
11:54.180 --> 11:56.980
in the VRRP environment.

207
11:56.980 --> 12:02.540
Again, it's getting statically routed out to 204 dot 186 dot 19 dot one.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

207
11:56.980 --> 12:02.540
Again, it's getting statically routed out to 204 dot 186 dot 19 dot one.

208
12:02.540 --> 12:09.100
And from there, it hits 72 dot 31 dot 136 dot 13, which is going out to my

209
12:09.100 --> 12:10.860
service provider.

210
12:10.860 --> 12:13.820
And at that point, it's off of my network.

211
12:13.820 --> 12:19.020
So we can see that this is working perfectly exactly as we designed.

212
12:19.020 --> 12:24.340
And now our on-prem SD WAN environment is complete.

213
12:24.340 --> 12:27.780
So this is all we had to configure in this skill.

214
12:27.780 --> 12:33.020
We wanted to get our environment up and running with management VPN zero.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

214
12:27.780 --> 12:33.020
We wanted to get our environment up and running with management VPN zero.

215
12:33.020 --> 12:39.290
We got our service VPN 10 working and routing traffic for a workstation on VLAN

216
12:39.290 --> 12:40.300
10 all the

217
12:40.300 --> 12:42.260
way out to the internet.

218
12:42.260 --> 12:44.380
So this accomplishes our goal.

219
12:44.380 --> 12:49.340
That means the only thing left to do is our challenge, which you can tackle

220
12:49.340 --> 12:49.940
next.

221
12:49.940 --> 12:53.420
I'll see you in the solution video for the challenge.