WEBVTT

1
00:00.000 --> 00:09.000
So our final step in getting all of this working is to configure a service VPN

2
00:09.000 --> 00:10.880
for VLAN 10.

3
00:10.880 --> 00:14.760
Now this is going to be very, very similar to the ones we've already done.

4
00:14.760 --> 00:17.480
It will have a few more interfaces in it.

5
00:17.480 --> 00:22.930
We're going to bring, for example, a loopback interface into OSPF and on the

6
00:22.930 --> 00:24.600
service side,

7
00:24.600 --> 00:30.620
leaning towards the clients, we're also going to run VRRP, which means that the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

7
00:24.600 --> 00:30.620
leaning towards the clients, we're also going to run VRRP, which means that the

8
00:30.620 --> 00:31.720
inside addresses

9
00:31.720 --> 00:34.880
on our routers are going to be a little bit different.

10
00:34.880 --> 00:41.640
So let's go ahead and jump in and configure our service VPN for VLAN 10.

11
00:41.640 --> 00:45.570
So since we've done this a few times now, we're just going to start right here

12
00:45.570 --> 00:45.960
in our

13
00:45.960 --> 00:48.520
device template configuration.

14
00:48.520 --> 00:54.560
And right here under VPN 512 is the service VPN section.

15
00:54.560 --> 00:58.240
So what we're going to be doing is adding a new service VPN.

16
00:58.240 --> 01:02.120
So of course, we simply just click on add VPN.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:58.240 --> 01:02.120
So of course, we simply just click on add VPN.

17
01:02.120 --> 01:07.610
Now there's quite a few templates here that we can actually use if we want to,

18
01:07.610 --> 01:08.280
and we could

19
01:08.280 --> 01:11.400
do some research and figure out what these different templates are.

20
01:11.400 --> 01:14.040
But for now, we're just going to create our own.

21
01:14.040 --> 01:18.280
So we're going to come down here to the bottom to this create VPN template.

22
01:18.280 --> 01:22.500
So we're going to configure our template name and description as we have been

23
01:22.500 --> 01:23.120
so far.

24
01:23.120 --> 01:25.680
This one of course for VPN 10.

25
01:25.680 --> 01:30.040
And notice that for the VPN, it defaults to putting in a zero here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
01:25.680 --> 01:30.040
And notice that for the VPN, it defaults to putting in a zero here.

26
01:30.040 --> 01:34.160
So we're going to have to actually tell it that it's VPN 10.

27
01:34.160 --> 01:38.100
The other thing we're going to do since this is ultimately going to be for

28
01:38.100 --> 01:39.120
internet access

29
01:39.120 --> 01:43.640
is we're going to set up a default IPV for static route.

30
01:43.640 --> 01:46.840
So let's go down to our IPV for route section.

31
01:46.840 --> 01:49.120
Here we'll say new IPV for route.

32
01:49.120 --> 01:53.120
Again, it's a default still pointing to a next hop.

33
01:53.120 --> 01:55.120
So we'll add our next hop.

34
01:55.120 --> 02:02.090
The next hop in my environment is 204 dot 186 dot 19 dot one, and we'll hit add
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
01:55.120 --> 02:02.090
The next hop in my environment is 204 dot 186 dot 19 dot one, and we'll hit add

35
02:02.090 --> 02:02.240
.

36
02:02.240 --> 02:05.280
Once again, don't forget to hit add over here on the right.

37
02:05.280 --> 02:09.310
We need to get this down to a single line so that we know it's actually

38
02:09.310 --> 02:10.960
properly configured.

39
02:10.960 --> 02:13.400
That's all we need in the VPN template itself.

40
02:13.400 --> 02:15.200
So let's hit save.

41
02:15.200 --> 02:19.200
And we'll highlight the template we just created, move it over to the window on

42
02:19.200 --> 02:21.000
the right and

43
02:21.000 --> 02:22.000
hit next.

44
02:22.000 --> 02:25.180
Now, as you can see, this is a little bit different because we add all of our

45
02:25.180 --> 02:26.720
additional templates

46
02:26.720 --> 02:28.280
right here.

47
02:28.280 --> 02:32.760
So actually what we're going to need here, we're going to add OSPF and then we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
02:28.280 --> 02:32.760
So actually what we're going to need here, we're going to add OSPF and then we

48
02:32.760 --> 02:33.080
're going

49
02:33.080 --> 02:37.200
to need three VPN interface ethernets.

50
02:37.200 --> 02:39.640
So we'll just go ahead and add them all together.

51
02:39.640 --> 02:43.280
And then let's start with configuring our OSPF template.

52
02:43.280 --> 02:45.400
We're going to create a new template.

53
02:45.400 --> 02:49.840
We'll set our template name and description, just like we did for VPN zero.

54
02:49.840 --> 02:52.440
But of course, we'll put 10 in there.

55
02:52.440 --> 02:55.080
Let's scroll down to area under area.

56
02:55.080 --> 02:57.120
We'll add a new area.

57
02:57.120 --> 02:59.840
This is also going to be area zero.

58
02:59.840 --> 03:02.280
We're going to add interfaces.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

58
02:59.840 --> 03:02.280
We're going to add interfaces.

59
03:02.280 --> 03:05.760
So let's start with our gigabit ethernet two dot 10.

60
03:05.760 --> 03:07.960
That's the inside interface.

61
03:07.960 --> 03:10.760
We'll do the same adjustments we did before.

62
03:10.760 --> 03:13.400
We'll set the hello interval to one.

63
03:13.400 --> 03:16.120
We'll set the dead interval to four.

64
03:16.120 --> 03:20.480
Then we'll add another interface, which you click on up here on the top left.

65
03:20.480 --> 03:23.080
This one we're going to add our loop back zero.

66
03:23.080 --> 03:26.340
For this one, we're not going to change the hello or dead intervals because

67
03:26.340 --> 03:26.720
what we're

68
03:26.720 --> 03:30.740
going to do instead is we're going to come down here to advanced options and we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
03:26.720 --> 03:30.740
going to do instead is we're going to come down here to advanced options and we

69
03:30.740 --> 03:31.120
're going

70
03:31.120 --> 03:34.400
to set this to be a passive interface.

71
03:34.400 --> 03:39.400
So we'll say passive interface on and then we'll hit add.

72
03:39.400 --> 03:44.600
And we can see that that's now added to interfaces to area zero.

73
03:44.600 --> 03:47.280
Again, let's not forget to hit add.

74
03:47.280 --> 03:48.640
That's all we need for our SPF.

75
03:48.640 --> 03:50.440
So let's hit save.

76
03:50.440 --> 03:53.560
And then let's start configuring our other interfaces.

77
03:53.560 --> 03:56.400
So let's just create a template for each one.

78
03:56.400 --> 04:01.000
So since we've done these numerous times now, we're just going to look at this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
03:56.400 --> 04:01.000
So since we've done these numerous times now, we're just going to look at this

79
04:01.000 --> 04:01.240
quickly.

80
04:01.240 --> 04:06.330
Here we can figure the template name, the description, no shut, the interface

81
04:06.330 --> 04:06.880
name, the

82
04:06.880 --> 04:12.750
description, and we've already set the IPv4 prefix to be device specific with

83
04:12.750 --> 04:13.680
the correct

84
04:13.680 --> 04:15.280
key.

85
04:15.280 --> 04:19.210
The thing that's going to be different on this interface is we also want it to

86
04:19.210 --> 04:21.200
run VRRP.

87
04:21.200 --> 04:23.760
So for that, we need to scroll down.

88
04:23.760 --> 04:26.520
And here we have a VRRP section.

89
04:26.520 --> 04:29.440
So let's go ahead and click new VRRP.

90
04:29.440 --> 04:32.600
Here we're going to set the group ID to 100.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
04:29.440 --> 04:32.600
Here we're going to set the group ID to 100.

91
04:32.600 --> 04:39.040
We're going to set the IP address, which is going to be 10.10.10.1.

92
04:39.040 --> 04:43.970
Now this is a global setting because both routers are going to use the same

93
04:43.970 --> 04:44.960
address as

94
04:44.960 --> 04:48.160
the VRRP virtual address.

95
04:48.160 --> 04:51.760
It also means that we're not going to be able to set router one to be dot one

96
04:51.760 --> 04:52.160
on this

97
04:52.160 --> 04:53.320
subnet.

98
04:53.320 --> 04:56.680
So we're going to have to set those addresses a little bit differently because

99
04:56.680 --> 04:57.200
dot one is

100
04:57.200 --> 05:00.760
now going to be taken by VRRP.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
04:57.200 --> 05:00.760
now going to be taken by VRRP.

101
05:00.760 --> 05:04.450
Now there's of course other things about VRRP here that you could set, but

102
05:04.450 --> 05:05.000
these will do

103
05:05.000 --> 05:06.040
for now.

104
05:06.040 --> 05:08.240
Let's go ahead and hit add.

105
05:08.240 --> 05:09.600
That's all we had to configure here.

106
05:09.600 --> 05:11.120
We can see that it's correct.

107
05:11.120 --> 05:13.440
So let's go ahead and hit save.

108
05:13.440 --> 05:16.120
And then we'll configure our next two interfaces.

109
05:16.120 --> 05:18.160
So let's make a new template.

110
05:18.160 --> 05:22.140
So here we're configuring our gigabit one interface, which is our outside

111
05:22.140 --> 05:23.000
interface.

112
05:23.000 --> 05:27.980
So typical configuration, we give it a name, description, shutdown is set to no

113
05:27.980 --> 05:29.120
, the interface

114
05:29.120 --> 05:34.610
name, a description, and we have the address set to device specific using a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

114
05:29.120 --> 05:34.610
name, a description, and we have the address set to device specific using a

115
05:34.610 --> 05:35.560
customized

116
05:35.560 --> 05:36.560
key.

117
05:36.560 --> 05:41.040
So now let's go ahead and hit save and finally the loop back.

118
05:41.040 --> 05:44.080
Once again, our template name is loop back zero.

119
05:44.080 --> 05:47.860
It's configuring the loop back zero interface, no shutting it, putting a

120
05:47.860 --> 05:49.280
description on it

121
05:49.280 --> 05:53.440
and the custom IP with the specific key.

122
05:53.440 --> 05:55.440
Once again, we save it.

123
05:55.440 --> 06:00.360
Now our template is fully configured, so now we can hit add.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
05:55.440 --> 06:00.360
Now our template is fully configured, so now we can hit add.

124
06:00.360 --> 06:05.560
So now we see we have our VPN template here in place under our service VPNs.

125
06:05.560 --> 06:09.440
So now we hit update to update our template.

126
06:09.440 --> 06:14.080
Now just like we saw previously, notice we have a gray X because now we have

127
06:14.080 --> 06:14.920
additional

128
06:14.920 --> 06:18.560
fields to put in for these new interfaces.

129
06:18.560 --> 06:22.720
The one that it's listing first is the loop back zero interface.

130
06:22.720 --> 06:26.720
So those are the addresses being used for the loop back zero.

131
06:26.720 --> 06:29.800
Next it wants the gigabit ethernet one.

132
06:29.800 --> 06:33.640
Those are the addresses for the outside interfaces.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
06:29.800 --> 06:33.640
Those are the addresses for the outside interfaces.

133
06:33.640 --> 06:40.000
And finally, if we scroll to the right, the address for the inside interfaces.

134
06:40.000 --> 06:42.760
So this is going to be 10 dot 10 dot 10 dot.

135
06:42.760 --> 06:47.760
And in this case, we're going to make router one, a dot two slash 24.

136
06:47.760 --> 06:53.280
And we're going to make router two, the 10 dot 10 dot 10 dot three slash 24.

137
06:53.280 --> 06:59.000
Remember, this is because VRRP is actually at dot one.

138
06:59.000 --> 07:01.960
So that takes care of all the new fields we added.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

138
06:59.000 --> 07:01.960
So that takes care of all the new fields we added.

139
07:01.960 --> 07:06.260
Notice of course, if we scroll to the right, that all the fields we filled in

140
07:06.260 --> 07:07.040
previously

141
07:07.040 --> 07:10.440
for other templates are still here.

142
07:10.440 --> 07:14.440
We only had to fill in the information for the new fields that we added.

143
07:14.440 --> 07:18.800
Now we have our two green checkboxes, so let's go ahead and hit next.

144
07:18.800 --> 07:21.590
Once again, if we wanted, we could review the configuration, but we've already

145
07:21.590 --> 07:21.920
looked

146
07:21.920 --> 07:22.920
at that.

147
07:22.920 --> 07:28.840
So let's just hit configure devices, confirm it, hit okay, and we'll check back

148
07:28.840 --> 07:29.440
in once

149
07:29.440 --> 07:31.240
this is successful.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
07:29.440 --> 07:31.240
this is successful.

150
07:31.240 --> 07:33.360
So here we see this is successful.

151
07:33.360 --> 07:38.640
Let's go ahead and SSH into just router one for now, and we can verify that

152
07:38.640 --> 07:39.520
things are

153
07:39.520 --> 07:40.680
working.

154
07:40.680 --> 07:46.800
So here we are in router one, and let's just start with a show VRF.

155
07:46.800 --> 07:53.480
Notice that we now have a VRF 10, which is for VPN 10.

156
07:53.480 --> 07:58.360
That's how the VPNs are represented on the iOS XE routers.

157
07:58.360 --> 08:00.200
It's actually a VRF.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

157
07:58.360 --> 08:00.200
It's actually a VRF.

158
08:00.200 --> 08:05.690
And we can see that the correct interfaces, gigabit one, gigabit two dot 10 and

159
08:05.690 --> 08:06.400
loop back

160
08:06.400 --> 08:09.560
zero are in that VRF.

161
08:09.560 --> 08:13.520
So let's change our routing context into that VRF.

162
08:13.520 --> 08:18.600
If you've never used routing context before, simply what this does is changes

163
08:18.600 --> 08:19.840
your perspective

164
08:19.840 --> 08:25.120
on the router as if you were inside of VRF 10.

165
08:25.120 --> 08:29.440
This prevents us from having to type VRF every time.

166
08:29.440 --> 08:34.430
So for example, we can just say show IP route, and it's going to show us the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

166
08:29.440 --> 08:34.430
So for example, we can just say show IP route, and it's going to show us the

167
08:34.430 --> 08:35.920
routes for VRF

168
08:35.920 --> 08:37.080
10.

169
08:37.080 --> 08:43.560
We don't have to say show IP route VRF 10 or when we do a ping specify the VRF.

170
08:43.560 --> 08:47.240
I can literally just say ping 10 dot 10 dot 10 dot.

171
08:47.240 --> 08:51.560
Well, let's try router two, which remember is dot three.

172
08:51.560 --> 08:54.600
So let's see if we can ping router two, we can see that successful.

173
08:54.600 --> 09:00.310
If we do a show IP OSPF interface, we can see our loop back is up and its
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

173
08:54.600 --> 09:00.310
If we do a show IP OSPF interface, we can see our loop back is up and its

174
09:00.310 --> 09:01.560
network type

175
09:01.560 --> 09:07.240
loop back, we see our gigabit two dot 10 is up as network type broadcast.

176
09:07.240 --> 09:10.340
Of course, we can also do a show IP OSPF neighbor.

177
09:10.340 --> 09:14.680
We see that we have a neighbor ship currently up with router two.

178
09:14.680 --> 09:19.040
If we do a show VRRP, we can see that VRRP is up.

179
09:19.040 --> 09:21.520
We are currently the backup router.

180
09:21.520 --> 09:26.000
And we can see that the master router listed down here further is the 10 dot 10

181
09:26.000 --> 09:26.680
dot 10

182
09:26.680 --> 09:28.160
dot three.

183
09:28.160 --> 09:32.570
The reason router two is the master right now is quite simply because it has a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

183
09:28.160 --> 09:32.570
The reason router two is the master right now is quite simply because it has a

184
09:32.570 --> 09:33.520
higher IP

185
09:33.520 --> 09:34.880
address.

186
09:34.880 --> 09:37.520
Both priorities are set to 100.

187
09:37.520 --> 09:42.040
Therefore it's going to the IP address for the tiebreaker here.

188
09:42.040 --> 09:46.380
And if our reachability is working properly from this VPN, we should be able to

189
09:46.380 --> 09:46.840
ping out

190
09:46.840 --> 09:50.640
to the internet and we can see that that's successful.

191
09:50.640 --> 09:55.080
But remember that our primary goal was to get there from our workstation.

192
09:55.080 --> 09:57.680
So let's go to our workstation.

193
09:57.680 --> 10:00.680
So here I'm on the console of workstation one.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

193
09:57.680 --> 10:00.680
So here I'm on the console of workstation one.

194
10:00.680 --> 10:04.260
And let's just verify that it can get to the internet.

195
10:04.260 --> 10:07.360
So we see here that that was successful.

196
10:07.360 --> 10:11.680
But let's actually trace it to see how it's exiting our environment.

197
10:11.680 --> 10:15.600
So of course, we're only concerned about the first couple hops here.

198
10:15.600 --> 10:17.520
After that, it's all the internet.

199
10:17.520 --> 10:21.780
But notice that it is going to 10 dot 10 dot 10 dot three, which we know is

200
10:21.780 --> 10:22.880
router two

201
10:22.880 --> 10:31.060
are active VRRP neighbor and it's going to 204 dot 186 dot 19 dot one next,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

201
10:22.880 --> 10:31.060
are active VRRP neighbor and it's going to 204 dot 186 dot 19 dot one next,

202
10:31.060 --> 10:31.520
which is

203
10:31.520 --> 10:33.440
our internet gateway.

204
10:33.440 --> 10:35.440
So this is clearly working.

205
10:35.440 --> 10:41.840
So now we have our SD WAN up and operating entirely as we designed.

206
10:41.840 --> 10:46.400
So in this video, we configured service VPN 10.

207
10:46.400 --> 10:52.820
We put three interfaces in it, our outside, our inside and a loop back, put OSP

208
10:52.820 --> 10:53.240
F on our

209
10:53.240 --> 10:57.840
loop back and our inside interface, configured a static route to send traffic

210
10:57.840 --> 10:58.800
to our internet

211
10:58.800 --> 11:00.160
gateway.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

211
10:58.800 --> 11:00.160
gateway.

212
11:00.160 --> 11:05.600
And we got all of this configured with VRRP on the inside interface to provide

213
11:05.600 --> 11:06.560
redundancy

214
11:06.560 --> 11:09.520
between router one and router two.

215
11:09.520 --> 11:14.540
Now that all that's done, we have achieved our goal of having our workstation

216
11:14.540 --> 11:14.880
get all

217
11:14.880 --> 11:16.720
the way out to the internet.

218
11:16.720 --> 11:21.080
So that concludes everything we need to cover in this skill.

219
11:21.080 --> 11:24.120
That leaves us with just the challenge.

220
11:24.120 --> 11:28.220
In this challenge, we're going to have you go in and try to configure a few

221
11:28.220 --> 11:28.920
things in

222
11:28.920 --> 11:33.920
SD WAN manager and make sure they take effect on our devices.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

222
11:28.920 --> 11:33.920
SD WAN manager and make sure they take effect on our devices.

223
11:33.920 --> 11:37.780
So good luck with the challenge and I'll see you on the other side with the

224
11:37.780 --> 11:38.440
solution.