WEBVTT

1
00:00.000 --> 00:09.850
So for our manual options, let's start off here on the CloudWatch Dashboards

2
00:09.850 --> 00:11.200
screen and

3
00:11.200 --> 00:16.560
notice that there's two sections here at the top, one for custom dashboards and

4
00:16.560 --> 00:17.320
one for

5
00:17.320 --> 00:19.560
automatic dashboards.

6
00:19.560 --> 00:22.720
Let's start with the automatic dashboards.

7
00:22.720 --> 00:27.580
So if we come up here to automatic dashboards, notice there's a couple things

8
00:27.580 --> 00:28.380
here you can

9
00:28.380 --> 00:30.000
choose from.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:30.000 --> 00:34.020
One of them is our VPC VPN.

11
00:34.020 --> 00:38.230
Let's go ahead and click on that and notice right here, it's sort of already

12
00:38.230 --> 00:38.840
built us a

13
00:38.840 --> 00:45.300
dashboard that's looking at the tunnel sum, the tunnel average and the tunnel

14
00:45.300 --> 00:46.420
data out.

15
00:46.420 --> 00:48.940
So it's already sort of built this dashboard for us.

16
00:48.940 --> 00:53.610
And if this gives us the information that we like, then we can just stick with

17
00:53.610 --> 00:54.180
this.

18
00:54.180 --> 00:58.400
In fact, there's even a choice up here to add it to the dashboard to make this

19
00:58.400 --> 00:59.240
a permanent

20
00:59.240 --> 01:00.320
addition.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
00:59.240 --> 01:00.320
addition.

21
01:00.320 --> 01:02.700
We can also make it a favorite.

22
01:02.700 --> 01:07.120
So this is one option we have for monitoring this on a dashboard.

23
01:07.120 --> 01:11.080
The other choice of course is we can go back to dashboards again.

24
01:11.080 --> 01:13.840
So once again, we'll go back to CloudWatch.

25
01:13.840 --> 01:18.090
And by the way, while we're on our way over there, notice now that favorites

26
01:18.090 --> 01:18.760
and recents

27
01:18.760 --> 01:22.680
is showing the information about our alarm.

28
01:22.680 --> 01:26.750
And if we go ahead and go back down here to dashboards here under custom dash

29
01:26.750 --> 01:27.440
boards, which

30
01:27.440 --> 01:32.200
is the default, we can come over here and say create a dashboard.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
01:27.440 --> 01:32.200
is the default, we can come over here and say create a dashboard.

31
01:32.200 --> 01:33.740
We'll give it a name.

32
01:33.740 --> 01:36.460
We will be super creative here.

33
01:36.460 --> 01:41.090
We will call this my dashboard because I am sure that name has never been used

34
01:41.090 --> 01:41.340
in all

35
01:41.340 --> 01:42.340
of history.

36
01:42.340 --> 01:45.860
So let's go down here and hit create dashboard.

37
01:45.860 --> 01:50.590
And now we can start choosing what we want on this dashboard, putting our

38
01:50.590 --> 01:51.500
widgets on the

39
01:51.500 --> 01:52.500
dashboard.

40
01:52.500 --> 01:56.780
Now, there's as you can see many, many different choices here.

41
01:56.780 --> 01:59.740
This of course could turn into a really big topic.

42
01:59.740 --> 02:02.780
I'm just going to show you basically how to build one.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
01:59.740 --> 02:02.780
I'm just going to show you basically how to build one.

43
02:02.780 --> 02:08.050
So let's say that we wanted our VPN monitor to be on instead of a line like we

44
02:08.050 --> 02:08.740
've seen

45
02:08.740 --> 02:12.420
so far, maybe we want this on a gauge.

46
02:12.420 --> 02:15.980
So we'll say gauge, we'll say next.

47
02:15.980 --> 02:18.740
Once again, we'll choose VPN.

48
02:18.740 --> 02:22.340
Once again, we'll choose across all VPN tunnels.

49
02:22.340 --> 02:25.620
And once again, we will choose tunnel state.

50
02:25.620 --> 02:30.220
Notice that it right away shows us this gauge up here at the top.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
02:25.620 --> 02:30.220
Notice that it right away shows us this gauge up here at the top.

51
02:30.220 --> 02:35.990
But we also have a message saying that you have to set the gauge range from the

52
02:35.990 --> 02:36.740
options

53
02:36.740 --> 02:37.740
tab.

54
02:37.740 --> 02:39.860
We can't just hit create yet.

55
02:39.860 --> 02:44.420
So we have to go over here to options and we have to set the range.

56
02:44.420 --> 02:49.660
The range for this is going to be zero to one.

57
02:49.660 --> 02:51.540
That's the range for the gauge.

58
02:51.540 --> 02:54.740
And then let's go ahead and hit create widget.

59
02:54.740 --> 02:57.460
And this will put the widget on our dashboard.

60
02:57.460 --> 03:01.940
And by the way, we've spent a lot of time here talking about this tunnel state
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:57.460 --> 03:01.940
And by the way, we've spent a lot of time here talking about this tunnel state

61
03:01.940 --> 03:02.580
and how

62
03:02.580 --> 03:04.980
do you know if it's zero or one?

63
03:04.980 --> 03:08.200
Well once you have it on a dashboard somewhere, you can click on this little I

64
03:08.200 --> 03:08.820
here for more

65
03:08.820 --> 03:10.780
information.

66
03:10.780 --> 03:14.940
And this will actually tell us that when you're looking at the state of a

67
03:14.940 --> 03:15.780
tunnel, there is

68
03:15.780 --> 03:20.900
a slight difference between static and BGP based VPNs.

69
03:20.900 --> 03:27.210
But essentially notice that it says one is either both VPNs are up or the state

70
03:27.210 --> 03:28.260
is established

71
03:28.260 --> 03:32.940
for a BGP and any value between zero and one.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
03:28.260 --> 03:32.940
for a BGP and any value between zero and one.

72
03:32.940 --> 03:37.620
So as you can see as it is right now, point five, it means that at least one of

73
03:37.620 --> 03:38.460
our tunnels

74
03:38.460 --> 03:40.100
is not up.

75
03:40.100 --> 03:44.540
Which we know that's correct because we literally took one of our tunnels down.

76
03:44.540 --> 03:49.130
So essentially it's telling us that our tunnels are well half up right now,

77
03:49.130 --> 03:49.940
which is entirely

78
03:49.940 --> 03:50.940
accurate.

79
03:50.940 --> 03:53.220
But that's how this metric works.

80
03:53.220 --> 03:57.540
Once you have everything on this dashboard you want, go ahead and hit save.

81
03:57.540 --> 04:01.140
It'll save the dashboard and well here we are looking at it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
03:57.540 --> 04:01.140
It'll save the dashboard and well here we are looking at it.

82
04:01.140 --> 04:05.560
But to get back to it later, let's just go back to the main cloud watch page

83
04:05.560 --> 04:05.940
again.

84
04:05.940 --> 04:09.500
This is now going to be under dashboards, my dashboard.

85
04:09.500 --> 04:13.060
So you can get right back to it just like that.

86
04:13.060 --> 04:17.120
So now that we've seen our cloud watch dashboards, the last sort of place we

87
04:17.120 --> 04:18.100
can go for manual

88
04:18.100 --> 04:22.420
information is actually on the VPC dashboard.

89
04:22.420 --> 04:24.420
So once again, I have a favorite for this.

90
04:24.420 --> 04:27.980
If you don't just navigate to VPC.

91
04:27.980 --> 04:32.280
Now here on the overall VPC dashboard, of course, this is going to give us
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
04:27.980 --> 04:32.280
Now here on the overall VPC dashboard, of course, this is going to give us

92
04:32.280 --> 04:33.100
information

93
04:33.100 --> 04:38.820
such as how many VPCs we have, subnets, route tables and so on.

94
04:38.820 --> 04:44.480
The main thing, of course, we would be here for is these two items right here,

95
04:44.480 --> 04:45.180
the virtual

96
04:45.180 --> 04:49.780
private gateways and the site to site VPN connections.

97
04:49.780 --> 04:54.390
These of course can also be accessed through our navigation menu over here on

98
04:54.390 --> 04:55.140
the left.

99
04:55.140 --> 04:58.220
They're just a little bit further down off the screen.

100
04:58.220 --> 05:01.660
So if we were to come down here, scroll down a little bit.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
04:58.220 --> 05:01.660
So if we were to come down here, scroll down a little bit.

101
05:01.660 --> 05:05.730
Just right here, we can also get to our virtual private gateways and our site

102
05:05.730 --> 05:06.300
to site VPN

103
05:06.300 --> 05:07.660
connections.

104
05:07.660 --> 05:12.430
Now if you weren't sure that your virtual private gateway was up and working

105
05:12.430 --> 05:13.260
properly,

106
05:13.260 --> 05:15.580
you could drill down here and look at it.

107
05:15.580 --> 05:19.800
The main thing you'd want to make sure if we click on it here, the most common

108
05:19.800 --> 05:20.400
mistake

109
05:20.400 --> 05:25.860
people make is they forget to attach it to their VPC.

110
05:25.860 --> 05:30.460
But as we can see in this case, our virtual private gateway, which is called V
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
05:25.860 --> 05:30.460
But as we can see in this case, our virtual private gateway, which is called V

111
05:30.460 --> 05:31.340
PG1, is

112
05:31.340 --> 05:33.420
in fact attached.

113
05:33.420 --> 05:36.790
The other thing we want to verify if we go back to the dashboard or it does

114
05:36.790 --> 05:37.420
navigate

115
05:37.420 --> 05:42.460
to whatever here on the left is the site to site VPN connection.

116
05:42.460 --> 05:47.620
So here it's listed as VPN one and the state is listed as available.

117
05:47.620 --> 05:52.340
That's all great, but is it actually healthy?

118
05:52.340 --> 05:54.820
How do we know if both tunnels are up?

119
05:54.820 --> 05:59.460
Well you can get far more information by clicking on the VPN ID right here and

120
05:59.460 --> 05:59.720
this

121
05:59.720 --> 06:05.320
will give us all the information about the VPC that we need, particularly down
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
05:59.720 --> 06:05.320
will give us all the information about the VPC that we need, particularly down

122
06:05.320 --> 06:06.020
here under

123
06:06.020 --> 06:07.860
tunnel details.

124
06:07.860 --> 06:11.660
We see that in fact our tunnel one is currently down.

125
06:11.660 --> 06:14.480
We see the tunnel two is currently up.

126
06:14.480 --> 06:17.880
We see the inside and outside addresses.

127
06:17.880 --> 06:23.960
And of course we can also see the last time this status changed.

128
06:23.960 --> 06:26.920
Also fairly important on this page.

129
06:26.920 --> 06:30.060
We'll go ahead and open tunnel one options.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

129
06:26.920 --> 06:30.060
We'll go ahead and open tunnel one options.

130
06:30.060 --> 06:32.900
You can open up tunnel two options as well if you want.

131
06:32.900 --> 06:35.700
That way we can have them all on the same page.

132
06:35.700 --> 06:40.590
But these are of course very common things that would be wrong in order for our

133
06:40.590 --> 06:41.140
tunnel

134
06:41.140 --> 06:42.620
not to be up.

135
06:42.620 --> 06:46.550
So this of course is a really good page to keep an eye on when you're troubles

136
06:46.550 --> 06:47.100
hooting

137
06:47.100 --> 06:51.410
because your phase one and your phase two encryption and integrity along with

138
06:51.410 --> 06:52.020
your Diffie

139
06:52.020 --> 06:57.610
Humming groups and so on all of this has to match what you've configured over

140
06:57.610 --> 06:58.080
on the

141
06:58.080 --> 07:00.120
iOS Xe side.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

141
06:58.080 --> 07:00.120
iOS Xe side.

142
07:00.120 --> 07:04.920
So if any of this is wrong you have to go back through and change it.

143
07:04.920 --> 07:09.400
You can either change it on the iOS Xe side if this represents the information

144
07:09.400 --> 07:09.960
you want

145
07:09.960 --> 07:16.340
to use or you can change this through AWS through the tunnel options up at the

146
07:16.340 --> 07:16.800
top of

147
07:16.800 --> 07:17.800
the page.

148
07:17.800 --> 07:22.120
Now just in the interest of leaving this functional let's go ahead and close

149
07:22.120 --> 07:23.160
our tunnel options

150
07:23.160 --> 07:27.560
back down and let's bring up our tunnel again.

151
07:27.560 --> 07:32.140
So back here on router one we'll simply do our no shut on the tunnel.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

151
07:27.560 --> 07:32.140
So back here on router one we'll simply do our no shut on the tunnel.

152
07:32.140 --> 07:34.500
We'll give it just a second here.

153
07:34.500 --> 07:36.800
We'll do our show IP interface brief.

154
07:36.800 --> 07:39.340
We see the tunnel two is back up.

155
07:39.340 --> 07:44.900
Now just to let you know, AWS is not going to realize the tunnel's back up

156
07:44.900 --> 07:45.360
quite that

157
07:45.360 --> 07:46.360
quickly.

158
07:46.360 --> 07:53.290
Notice it's still showing tunnel one as down and even if I refresh this it's

159
07:53.290 --> 07:54.120
still showing

160
07:54.120 --> 07:55.420
down.

161
07:55.420 --> 08:01.010
In my experience this usually takes about I would say 30 seconds to a minute
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

161
07:55.420 --> 08:01.010
In my experience this usually takes about I would say 30 seconds to a minute

162
08:01.010 --> 08:01.440
until this

163
08:01.440 --> 08:04.720
actually reports that the tunnel is back up.

164
08:04.720 --> 08:08.140
So let's just wait until this comes back up so that we can verify what this

165
08:08.140 --> 08:08.640
output is

166
08:08.640 --> 08:11.960
supposed to look like when it's completely functional.

167
08:11.960 --> 08:17.370
Specifically of course the down should change to an up and this warning message

168
08:17.370 --> 08:18.040
telling

169
08:18.040 --> 08:23.070
us that the VPN connection is not using both tunnels should of course go away

170
08:23.070 --> 08:23.560
if we are

171
08:23.560 --> 08:25.280
using both tunnels.

172
08:25.280 --> 08:29.690
I could of course manually close that warning but we want to make sure that it

173
08:29.690 --> 08:30.280
closes on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

173
08:29.690 --> 08:30.280
closes on

174
08:30.280 --> 08:31.560
its own.

175
08:31.560 --> 08:34.770
So again this just took a few minutes and now we can see that both of our

176
08:34.770 --> 08:35.400
tunnels are

177
08:35.400 --> 08:38.440
up and that warning message is gone away.

178
08:38.440 --> 08:44.000
So this of course is what our VPN detail page should look like when everything

179
08:44.000 --> 08:46.320
is functional.

180
08:46.320 --> 08:51.200
So in this video we jumped in and took a look at some of the tools that we have

181
08:51.200 --> 08:52.000
available

182
08:52.000 --> 08:57.950
in AWS as far as logging, getting notifications and alarms, dashboard

183
08:57.950 --> 08:59.440
information that we can

184
08:59.440 --> 09:04.380
watch in real time to see what's going on with our tunnels and other places we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

184
08:59.440 --> 09:04.380
watch in real time to see what's going on with our tunnels and other places we

185
09:04.380 --> 09:04.760
can go

186
09:04.760 --> 09:10.400
look such as our VPN details here to make sure that our VPN is up and

187
09:10.400 --> 09:11.800
functional.

188
09:11.800 --> 09:16.940
Next, let's take a look at some of this similar information instead for

189
09:16.940 --> 09:18.320
Microsoft Azure.

190
09:18.320 --> 09:28.320
[BLANK_AUDIO]