WEBVTT

1
00:00.000 --> 00:09.700
As we mentioned previously, if we want SD-WAN to talk to the real world outside

2
00:09.700 --> 00:11.100
of our private

3
00:11.100 --> 00:16.160
little lab environment, well, we may have some issues with NAT.

4
00:16.160 --> 00:21.980
Cisco's recommendation for deploying SD-WAN says that all of your controllers,

5
00:21.980 --> 00:23.240
your VSmart,

6
00:23.240 --> 00:29.470
your VManage, and your Validator or VBond all should have their own public IP

7
00:29.470 --> 00:31.040
address.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

7
00:29.470 --> 00:31.040
address.

8
00:31.040 --> 00:35.800
And if that's not possible, they do have some port forwarding that we can do

9
00:35.800 --> 00:37.480
for the VSmart

10
00:37.480 --> 00:40.480
and the VManage controllers.

11
00:40.480 --> 00:46.680
However, where the problem comes in is with the VBond or the Validator.

12
00:46.680 --> 00:53.510
They still say that it can work behind NAT, but it has to be a one-to-one NAT

13
00:53.510 --> 00:54.720
mapping.

14
00:54.720 --> 01:00.390
Now what that means is that all of the ports on a particular IP address have to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:54.720 --> 01:00.390
Now what that means is that all of the ports on a particular IP address have to

15
01:00.390 --> 01:01.440
be forwarded

16
01:01.440 --> 01:03.440
to the VBond server.

17
01:03.440 --> 01:08.670
Now I'm sure that with maybe a lot of network analysis, we could maybe figure

18
01:08.670 --> 01:09.600
out exactly

19
01:09.600 --> 01:11.680
which ports need to be forwarded.

20
01:11.680 --> 01:16.800
However, Cisco certainly does not publish that, their answer is simply one-to-

21
01:16.800 --> 01:17.320
one NAT

22
01:17.320 --> 01:24.420
mapping, which means you have to have at least two public IP addresses in order

23
01:24.420 --> 01:26.000
to run SD-WAN

24
01:26.000 --> 01:31.930
properly, one that you can put VBond behind or the Validator behind and do a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
01:26.000 --> 01:31.930
properly, one that you can put VBond behind or the Validator behind and do a

25
01:31.930 --> 01:32.960
one-to-one

26
01:32.960 --> 01:37.440
mapping, and then the other one can have the other controllers.

27
01:37.440 --> 01:42.680
So your VManage and multiple SD-WAN controllers.

28
01:42.680 --> 01:47.470
Now the problem with that for most of us that are studying this topic, you

29
01:47.470 --> 01:48.440
probably don't

30
01:48.440 --> 01:52.880
have two public IP addresses at your disposal.

31
01:52.880 --> 01:54.520
I don't either.

32
01:54.520 --> 01:59.100
So what I did is I actually found a relative who was willing to let me put a

33
01:59.100 --> 02:00.160
little server
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

33
01:59.100 --> 02:00.160
little server

34
02:00.160 --> 02:04.960
at their house and they're not doing any other port forwarding, so I was able

35
02:04.960 --> 02:06.040
to do a one-to-one

36
02:06.040 --> 02:11.930
NAT mapping on their router and forward all of that traffic into the VBond

37
02:11.930 --> 02:12.880
server.

38
02:12.880 --> 02:18.080
The VBond server is then at its own separate outside public address.

39
02:18.080 --> 02:22.940
So it's a little bit to configure, but ultimately we don't really need much on

40
02:22.940 --> 02:24.200
that other side,

41
02:24.200 --> 02:26.560
it's just a VBond controller.

42
02:26.560 --> 02:28.040
So let's go ahead and jump in.

43
02:28.040 --> 02:33.850
I'll show you how I have the NAT set up at my main location, where by VManage
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

43
02:28.040 --> 02:33.850
I'll show you how I have the NAT set up at my main location, where by VManage

44
02:33.850 --> 02:34.280
and the

45
02:34.280 --> 02:39.510
VSmart controllers are, and then I'll also show you how I can figure the

46
02:39.510 --> 02:39.920
network for

47
02:39.920 --> 02:41.880
where the VBond controller is.

48
02:41.880 --> 02:43.280
So let's go ahead and jump in.

49
02:43.280 --> 02:47.960
We'll start by looking at my network configuration.

50
02:47.960 --> 02:51.770
So starting off here on my network, or what I'm considering to be the

51
02:51.770 --> 02:53.560
headquarters network,

52
02:53.560 --> 02:58.860
where our single controller and our manager live, you can see here two things I

53
02:58.860 --> 02:59.440
really

54
02:59.440 --> 03:01.000
want to point out.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
02:59.440 --> 03:01.000
want to point out.

55
03:01.000 --> 03:05.940
Obviously I have some of this blurred out for privacy reasons, but the point is

56
03:05.940 --> 03:06.160
you can

57
03:06.160 --> 03:09.440
still see that I have quite a few rules here.

58
03:09.440 --> 03:14.050
I'm hosting some servers for some people, plus I have things like gaming

59
03:14.050 --> 03:15.000
machines that

60
03:15.000 --> 03:17.320
get ports forwarded to them and so on.

61
03:17.320 --> 03:20.480
So I have some ports being forwarded here.

62
03:20.480 --> 03:24.960
This is partially why I couldn't get away with the one-to-one NAT that we need

63
03:24.960 --> 03:26.120
for VBond

64
03:26.120 --> 03:28.800
here at this location.

65
03:28.800 --> 03:33.360
So instead I put the manager and the controller here, and if we look at these
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
03:28.800 --> 03:33.360
So instead I put the manager and the controller here, and if we look at these

66
03:33.360 --> 03:34.360
four lines, the

67
03:34.360 --> 03:40.300
third column here represents the outside port for traffic coming in, and then

68
03:40.300 --> 03:41.160
the fourth

69
03:41.160 --> 03:45.900
column here represents what private internal address that traffic is going to

70
03:45.900 --> 03:46.760
be forwarded

71
03:46.760 --> 03:49.560
to on which port.

72
03:49.560 --> 03:52.910
So when you're setting up your port forwarding rules, these are the ports that

73
03:52.910 --> 03:53.400
you want to

74
03:53.400 --> 03:57.000
use for this configuration.

75
03:57.000 --> 04:02.430
So note that if your firewall doesn't automatically allow traffic for these
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
03:57.000 --> 04:02.430
So note that if your firewall doesn't automatically allow traffic for these

76
04:02.430 --> 04:03.960
ports, you may have

77
04:03.960 --> 04:08.360
to also permit this traffic on your firewall.

78
04:08.360 --> 04:12.640
In case you don't recognize this interface, I'm actually running ubiquity here

79
04:12.640 --> 04:13.560
at my house,

80
04:13.560 --> 04:18.440
their Unifi product, and when you add a port forward here, it actually does

81
04:18.440 --> 04:19.520
automatically

82
04:19.520 --> 04:23.760
add an inbound forwarding rule in the firewall.

83
04:23.760 --> 04:27.520
But ultimately, these are the ports you need to forward.

84
04:27.520 --> 04:33.630
Let's also jump in and take a look at the remote site where I have my validator
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
04:27.520 --> 04:33.630
Let's also jump in and take a look at the remote site where I have my validator

85
04:33.630 --> 04:34.720
running.

86
04:34.720 --> 04:39.490
So the first thing I want to show you here is at the remote location, I'm

87
04:39.490 --> 04:40.400
simply using

88
04:40.400 --> 04:42.120
eVNG.

89
04:42.120 --> 04:45.520
In fact, I'm using the free version of eVNG.

90
04:45.520 --> 04:50.070
I simply installed that on a little micro PC, and it's literally running

91
04:50.070 --> 04:51.120
nothing except

92
04:51.120 --> 04:53.840
this one V-bond server.

93
04:53.840 --> 04:58.210
Now I do have two ethernet connections on it, one going out to the internet and

94
04:58.210 --> 04:59.120
one to use

95
04:59.120 --> 05:00.120
for management.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
04:59.120 --> 05:00.120
for management.

96
05:00.120 --> 05:03.480
Truth be told, they both link out to the same network.

97
05:03.480 --> 05:05.920
They're just one IP address apart.

98
05:05.920 --> 05:10.790
So really, you don't need the management interface here, but I put it on just

99
05:10.790 --> 05:11.600
in case.

100
05:11.600 --> 05:17.280
So this is literally all that's running on eVNG at the remote location.

101
05:17.280 --> 05:22.080
And then all I did is configure their firewall, let me switch over to that.

102
05:22.080 --> 05:26.440
Now of course, this would be different depending completely on your firewall.

103
05:26.440 --> 05:32.080
This is a Republic of Gamers Raptor GT AC 5300.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
05:26.440 --> 05:32.080
This is a Republic of Gamers Raptor GT AC 5300.

104
05:32.080 --> 05:37.270
So this is essentially a gaming router, slightly older one at this point, but

105
05:37.270 --> 05:38.200
honestly, it's

106
05:38.200 --> 05:40.720
a hand me down, I gave them this.

107
05:40.720 --> 05:44.360
But the point is each router is going to of course be different.

108
05:44.360 --> 05:49.410
However, they're all a little bit similar in that they'll probably be somewhere

109
05:49.410 --> 05:49.600
under

110
05:49.600 --> 05:56.480
the NAT or port forwarding rules where you can configure this setting for a DMZ

111
05:56.480 --> 05:56.520
.

112
05:56.520 --> 06:02.760
The DMZ simply means that all ports that are not specified by something else,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
05:56.520 --> 06:02.760
The DMZ simply means that all ports that are not specified by something else,

113
06:02.760 --> 06:03.360
for example,

114
06:03.360 --> 06:09.600
port forwarding, all other ports will be forwarded to this one device.

115
06:09.600 --> 06:17.280
This one device that I have listed here as the 192.168.1.32, that is in fact

116
06:17.280 --> 06:18.080
that VBON

117
06:18.080 --> 06:21.920
server that's running on the eVNG server.

118
06:21.920 --> 06:28.840
Now I do have one port forwarding rule set up on here in addition to the DMZ.

119
06:28.840 --> 06:32.040
And that is simply here if we go to virtual port forwarding.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
06:28.840 --> 06:32.040
And that is simply here if we go to virtual port forwarding.

120
06:32.040 --> 06:34.320
Notice I have this one port.

121
06:34.320 --> 06:40.920
I just picked external port 7000, but it's forwarding to port 3389, which is

122
06:40.920 --> 06:41.800
the address

123
06:41.800 --> 06:45.640
of the machine that I'm actually remote desktoped into here to be able to show

124
06:45.640 --> 06:46.320
you this.

125
06:46.320 --> 06:51.220
This is in case I need to be able to fix something or maybe rebuild that VBON

126
06:51.220 --> 06:52.280
server if I need

127
06:52.280 --> 06:56.080
to, but this is what I'm using for remote access.

128
06:56.080 --> 07:02.450
So for the DMZ, all the ports are forwarding to the VBON except this one port
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

128
06:56.080 --> 07:02.450
So for the DMZ, all the ports are forwarding to the VBON except this one port

129
07:02.450 --> 07:04.240
7000 that's

130
07:04.240 --> 07:07.960
going to this remote desktop so I can do remote management.

131
07:07.960 --> 07:09.920
And again, everything is working fine.

132
07:09.920 --> 07:16.010
So apparently on the list of ports used by VBON, apparently port 7000 is in a

133
07:16.010 --> 07:17.000
problem.

134
07:17.000 --> 07:21.200
But nonetheless, this is how I have it configured so that we can get around the

135
07:21.200 --> 07:22.040
NAT issues to

136
07:22.040 --> 07:24.480
run SDWAN.

137
07:24.480 --> 07:29.230
So in this video, I just wanted to take a few minutes to show you how to set up

138
07:29.230 --> 07:29.640
the NAT

139
07:29.640 --> 07:35.060
forwarding rules that we need for the on-site location or on-prem, as well as
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

139
07:29.640 --> 07:35.060
forwarding rules that we need for the on-site location or on-prem, as well as

140
07:35.060 --> 07:35.960
wherever you're

141
07:35.960 --> 07:38.800
going to set up your VBON server.

142
07:38.800 --> 07:42.190
Now again, for a lot of companies, if you're doing this for work, you're going

143
07:42.190 --> 07:42.600
to have

144
07:42.600 --> 07:47.250
all the public IP addresses you need, in which case, just assign public IP

145
07:47.250 --> 07:48.280
addresses to these

146
07:48.280 --> 07:51.160
devices and you don't have any of these issues.

147
07:51.160 --> 07:55.320
But if you are trying to set this up in an environment where you only have one

148
07:55.320 --> 07:55.880
address

149
07:55.880 --> 08:01.190
available like at your home or at my home, you may have to find somebody else
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
07:55.880 --> 08:01.190
available like at your home or at my home, you may have to find somebody else

150
08:01.190 --> 08:01.800
who's

151
08:01.800 --> 08:07.000
willing to help you out with hosting just a little VBON server so that you can

152
08:07.000 --> 08:08.240
put everything

153
08:08.240 --> 08:12.280
behind a DMZ host on that firewall.

154
08:12.280 --> 08:15.580
But now that we have this set up, let's move on and take a look at the

155
08:15.580 --> 08:16.520
templates that we

156
08:16.520 --> 08:20.760
need to set up to support SDWAN Cloud on-RAMP.

157
08:20.760 --> 08:29.100
[BLANK_AUDIO]