WEBVTT 1 00:00.000 --> 00:08.080 So let's begin with talking about troubleshooting the SD-WAN underlay. 2 00:08.080 --> 00:12.510 Now the underlay has the same characteristics here that it does in say for 3 00:12.510 --> 00:13.920 example IPsec. 4 00:13.920 --> 00:18.250 We have to have things like an outside interface, which has to have an IP 5 00:18.250 --> 00:19.800 address, either statically 6 00:19.800 --> 00:22.480 assigned or from DHCP. 7 00:22.480 --> 00:24.520 We have to have some sort of routing. 8 00:24.520 --> 00:28.680 We need to know how to reach the other side of our proposed tunnel. 9 00:28.680 --> 00:34.680 Now that might be a static default, that might be BGP, full or partial tables. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 9 00:28.680 --> 00:34.680 Now that might be a static default, that might be BGP, full or partial tables. 10 00:34.680 --> 00:37.800 But the point is we have to have some sort of reachability. 11 00:37.800 --> 00:43.420 And in the case of things like cloud on ramp, we also might need DNS or name 12 00:43.420 --> 00:44.760 resolution, 13 00:44.760 --> 00:49.920 because this is how VManage or SD-WAN Manager is going to know how to reach the 14 00:49.920 --> 00:50.960 various cloud 15 00:50.960 --> 00:54.920 providers in order to do cloud on ramp. 16 00:54.920 --> 00:59.350 Our goal in this video is going to be to focus more on the things that are 17 00:59.350 --> 01:01.880 specific to SD-WAN WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 17 00:59.350 --> 01:01.880 specific to SD-WAN 18 01:01.880 --> 01:04.160 when it comes to the underlay. 19 01:04.160 --> 01:06.160 So that's exactly what we're going to do. 20 01:06.160 --> 01:11.360 So let's jump in and talk about the various attributes and tools that we have 21 01:11.360 --> 01:12.520 to troubleshoot 22 01:12.520 --> 01:16.760 the SD-WAN underlay. 23 01:16.760 --> 01:20.360 So of course, one of the first things we need to worry about in regards to the 24 01:20.360 --> 01:21.400 underlay is 25 01:21.400 --> 01:28.070 the outside interface or the interface that's going to be in VPN zero, which of 26 01:28.070 --> 01:28.840 course is 27 01:28.840 --> 01:31.480 the underlay in SD-WAN. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 27 01:28.840 --> 01:31.480 the underlay in SD-WAN. 28 01:31.480 --> 01:37.520 So the first thing is of course, we have to have at least one interface in VPN 29 01:37.520 --> 01:38.280 zero. 30 01:38.280 --> 01:43.460 Now we can of course have more than one interface, but we have to have at least 31 01:43.460 --> 01:44.040 one. 32 01:44.040 --> 01:47.640 That interface must have an IP address. 33 01:47.640 --> 01:52.080 Now that IP address can be statically assigned, of course, if you have static 34 01:52.080 --> 01:53.040 addresses for 35 01:53.040 --> 01:58.540 your wide area network, or it could be assigned by DHCP, usually from your 36 01:58.540 --> 02:00.200 service provider. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 36 01:58.540 --> 02:00.200 service provider. 37 02:00.200 --> 02:02.640 So both of those options are available. 38 02:02.640 --> 02:07.310 We also have to configure a color on it, such as Biz internet or MPLS, 39 02:07.310 --> 02:08.560 something along 40 02:08.560 --> 02:13.080 those lines, and we have to have an encapsulation. 41 02:13.080 --> 02:19.880 All three of these then are part of the T-lock or the transport location. 42 02:19.880 --> 02:24.840 Transport locations are going to be the endpoints for our tunnels. 43 02:24.840 --> 02:29.290 These endpoints then of course have to be shared with other devices on the 44 02:29.290 --> 02:30.120 network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 44 02:29.290 --> 02:30.120 network. 45 02:30.120 --> 02:36.000 They get shared through Overlay Management Protocol or OMP. 46 02:36.000 --> 02:40.120 We'll actually be talking much more about this protocol moving forward. 47 02:40.120 --> 02:44.040 The other piece we have to have of course is routing. 48 02:44.040 --> 02:49.010 And routing in this case can be really almost anything, but static default 49 02:49.010 --> 02:49.960 would be very 50 02:49.960 --> 02:52.680 common, particularly in a smaller environment. 51 02:52.680 --> 02:56.320 We just have a static default route pointing to our service provider. 52 02:56.320 --> 03:00.220 When we start getting into larger networks, we might get a dynamic default, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 52 02:56.320 --> 03:00.220 When we start getting into larger networks, we might get a dynamic default, 53 03:00.220 --> 03:01.000 getting it 54 03:01.000 --> 03:03.440 from BGP. 55 03:03.440 --> 03:07.270 And more importantly, we might start getting things like either partial tables 56 03:07.270 --> 03:09.000 from BGP 57 03:09.000 --> 03:12.120 or full tables from BGP. 58 03:12.120 --> 03:15.770 If you're not completely familiar with the difference between these two, it's 59 03:15.770 --> 03:16.440 what internet 60 03:16.440 --> 03:20.040 routes are you getting from your service provider? 61 03:20.040 --> 03:23.970 Partial tables simply means that the BGP updates we're going to get from our 62 03:23.970 --> 03:25.480 service provider 63 03:25.480 --> 03:30.600 are only going to be for other customers of that service provider. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 63 03:25.480 --> 03:30.600 are only going to be for other customers of that service provider. 64 03:30.600 --> 03:35.600 Full tables means that we will be getting the full internet routing table. 65 03:35.600 --> 03:39.600 Now there's several reasons that we might be getting any of these three options 66 03:39.600 --> 03:39.840 from 67 03:39.840 --> 03:40.840 BGP. 68 03:40.840 --> 03:44.890 It's a little bit beyond the scope of what we're discussing here as far as why 69 03:44.890 --> 03:45.280 you would 70 03:45.280 --> 03:47.720 want each of these options. 71 03:47.720 --> 03:51.280 But it really has to do with which service providers you hooked up to. 72 03:51.280 --> 03:52.440 Is it multi-home? 73 03:52.440 --> 03:55.080 Are we connected to two different service providers? 74 03:55.080 --> 03:59.250 Again, a lot of different discussions there having to do with designing our 75 03:59.250 --> 04:01.040 internet routing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 75 03:59.250 --> 04:01.040 internet routing. 76 04:01.040 --> 04:06.600 But as far as SD-WAN is concerned, the important thing is we need to have a way 77 04:06.600 --> 04:07.280 to reach the 78 04:07.280 --> 04:09.920 other end of our proposed tunnel. 79 04:09.920 --> 04:15.330 Again, be that a cloud, another remote site, whatever it is, we have to have 80 04:15.330 --> 04:15.920 some form of 81 04:15.920 --> 04:17.960 reachability here. 82 04:17.960 --> 04:22.880 Something else to be aware of with the SD-WAN underlay is we use something here 83 04:22.880 --> 04:23.800 called gateway 84 04:23.800 --> 04:25.480 tracking. 85 04:25.480 --> 04:31.160 And it's talking about specifically the next hop of a given route. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 85 04:25.480 --> 04:31.160 And it's talking about specifically the next hop of a given route. 86 04:31.160 --> 04:34.920 Now this is going to be used just for static routes. 87 04:34.920 --> 04:39.960 And the reason is we don't really need it if we were using a BGP option because 88 04:39.960 --> 04:40.300 if a 89 04:40.300 --> 04:45.690 gateway goes down, we'll lose the BGP neighborhood and we'll lose the BGP 90 04:45.690 --> 04:46.600 routes. 91 04:46.600 --> 04:52.310 So BGP being a dynamic routing protocol pretty much takes care of itself here 92 04:52.310 --> 04:53.160 where a static 93 04:53.160 --> 04:54.840 route isn't the case. 94 04:54.840 --> 05:00.450 We just point a static route to a particular next hop and we don't really check WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 94 04:54.840 --> 05:00.450 We just point a static route to a particular next hop and we don't really check 95 05:00.450 --> 05:01.120 if that 96 05:01.120 --> 05:03.440 next hop is up or down. 97 05:03.440 --> 05:06.160 That's where gateway tracking comes in. 98 05:06.160 --> 05:10.200 It's going to track the next hop of that default route. 99 05:10.200 --> 05:14.990 That way we know if this default route is actually valid, which we don't get 100 05:14.990 --> 05:16.040 from traditional 101 05:16.040 --> 05:22.730 static routes, this uses address resolution protocol or ARP as it's probing 102 05:22.730 --> 05:23.760 mechanism 103 05:23.760 --> 05:28.520 and it sends these probes every 10 seconds. 104 05:28.520 --> 05:33.480 Once it detects the failure of the gateway address, it will of course stop WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 104 05:28.520 --> 05:33.480 Once it detects the failure of the gateway address, it will of course stop 105 05:33.480 --> 05:34.280 using this 106 05:34.280 --> 05:36.160 static route. 107 05:36.160 --> 05:39.320 Now a couple of little attributes about gateway tracking here. 108 05:39.320 --> 05:42.040 First, this is enabled by default. 109 05:42.040 --> 05:44.800 So you don't have to do anything to enable this feature. 110 05:44.800 --> 05:50.320 It does it automatically for static routes and it also cannot be disabled. 111 05:50.320 --> 05:54.720 This is a feature that's on enabled and cannot be disabled. 112 05:54.720 --> 06:00.800 The other cool thing of course is when that gateway comes back up and the ARP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 112 05:54.720 --> 06:00.800 The other cool thing of course is when that gateway comes back up and the ARP 113 06:00.800 --> 06:01.680 probe starts 114 06:01.680 --> 06:08.640 working again, this will auto recover and start using that default route again. 115 06:08.640 --> 06:12.320 So auto recovery is part of this process. 116 06:12.320 --> 06:17.280 Now as far as SD-WAN goes with any failures in the underlay, this is usually 117 06:17.280 --> 06:17.920 going to 118 06:17.920 --> 06:20.280 affect two different aspects. 119 06:20.280 --> 06:26.370 First, it's going to affect the datagram transport layer security or the dtls 120 06:26.370 --> 06:27.640 connection, which 121 06:27.640 --> 06:31.240 is what's used for the control plane. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 121 06:27.640 --> 06:31.240 is what's used for the control plane. 122 06:31.240 --> 06:37.340 So we'll lose our control plane connection to the controllers, to the manager, 123 06:37.340 --> 06:37.920 to the 124 06:37.920 --> 06:39.320 validator. 125 06:39.320 --> 06:43.300 So this of course is going to cause issues, but don't forget it's also going to 126 06:43.300 --> 06:43.800 affect 127 06:43.800 --> 06:49.430 the IP set tunnels and therefore the data plane, the actual forwarding of 128 06:49.430 --> 06:50.440 traffic. 129 06:50.440 --> 06:54.600 So what are some things that we need to watch for when we're trying to troubles 130 06:54.600 --> 06:55.080 hoot the 131 06:55.080 --> 06:57.360 SD-WAN underlay? 132 06:57.360 --> 07:01.070 So one of the things that can be incorrect that's going to really cause us an WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 132 06:57.360 --> 07:01.070 So one of the things that can be incorrect that's going to really cause us an 133 07:01.070 --> 07:02.000 issue is 134 07:02.000 --> 07:05.400 the enterprise route certificate. 135 07:05.400 --> 07:09.810 Now the reason we say if needed here, this of course is if you're using your 136 07:09.810 --> 07:10.880 own enterprise 137 07:10.880 --> 07:15.780 route authority, if you're using a third party certificate authority that is 138 07:15.780 --> 07:16.600 recognized 139 07:16.600 --> 07:19.960 by Cisco, this won't be a problem. 140 07:19.960 --> 07:23.710 However, if you're using your own certificate authority, this is something we 141 07:23.710 --> 07:24.400 have to watch 142 07:24.400 --> 07:29.750 out for, making sure that that route certificate is installed on all of our 143 07:29.750 --> 07:30.760 devices. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 143 07:29.750 --> 07:30.760 devices. 144 07:30.760 --> 07:35.320 We also need to make sure that the system block is configured properly. 145 07:35.320 --> 07:40.040 We need to make sure that we have correct and accurate system IPs, particularly 146 07:40.040 --> 07:40.400 that 147 07:40.400 --> 07:43.200 there's no overlap and duplication. 148 07:43.200 --> 07:46.840 We need to make sure that our site IDs are set correctly. 149 07:46.840 --> 07:51.440 We need to make sure that all of the devices have the same organizational name 150 07:51.440 --> 07:52.040 and we have 151 07:52.040 --> 07:58.940 to make sure that everybody is pointing to the same validator or V-bond address 152 07:58.940 --> 07:58.960 . 153 07:58.960 --> 08:02.760 So all of these things need to be correct in the system block. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 153 07:58.960 --> 08:02.760 So all of these things need to be correct in the system block. 154 08:02.760 --> 08:08.720 We also of course have VPN zero itself, which we already mentioned needs and 155 08:08.720 --> 08:09.760 interface, 156 08:09.760 --> 08:15.200 but it also needs to have tunnel option set under the VPN. 157 08:15.200 --> 08:18.000 And of course, it has to have that IP address. 158 08:18.000 --> 08:19.640 We did mention that earlier. 159 08:19.640 --> 08:25.320 And again, it can be either from DHCP or statically assigned. 160 08:25.320 --> 08:30.160 Another thing that a lot of people don't think about is the system clock must WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 160 08:25.320 --> 08:30.160 Another thing that a lot of people don't think about is the system clock must 161 08:30.160 --> 08:30.880 also be 162 08:30.880 --> 08:32.880 correct. 163 08:32.880 --> 08:38.360 Certificates and such authentication often only allows for a certain window of 164 08:38.360 --> 08:38.880 time to 165 08:38.880 --> 08:41.320 be different between the devices. 166 08:41.320 --> 08:44.560 So we need to make sure our system clocks are set correctly. 167 08:44.560 --> 08:49.920 And of course, we have some good commands we can use to verify these things. 168 08:49.920 --> 08:55.000 We can do show control local properties to verify our system block. 169 08:55.000 --> 08:58.950 And we can do, for example, show clock to view to make sure the clock is 170 08:58.950 --> 08:59.800 correct and 171 08:59.800 --> 09:03.400 we can do a clock set if it's incorrect. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 171 08:59.800 --> 09:03.400 we can do a clock set if it's incorrect. 172 09:03.400 --> 09:07.600 So let's hop over to the command line real quick and check out these commands. 173 09:07.600 --> 09:11.200 So let's start off with our show control local properties. 174 09:11.200 --> 09:16.450 Now this being on an iOS X e based router, we have to say show SD when control 175 09:16.450 --> 09:17.000 local 176 09:17.000 --> 09:18.000 properties. 177 09:18.000 --> 09:20.440 So let's go ahead and enter here. 178 09:20.440 --> 09:24.580 So in our first block of information here, we see that the personality is set 179 09:24.580 --> 09:25.080 to be a 180 09:25.080 --> 09:26.160 V edge. 181 09:26.160 --> 09:31.720 We see our organization name and we see our root CA chain status. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 181 09:26.160 --> 09:31.720 We see our organization name and we see our root CA chain status. 182 09:31.720 --> 09:33.800 So all of that looks good. 183 09:33.800 --> 09:37.470 Next we see, of course, the actual certificate status itself, where it's 184 09:37.470 --> 09:38.360 installed and it's 185 09:38.360 --> 09:41.920 valid with its beginning and ending dates. 186 09:41.920 --> 09:46.880 Down here in the bottom block, we see the DNS name, the site ID that we were 187 09:46.880 --> 09:47.560 talking 188 09:47.560 --> 09:48.560 about. 189 09:48.560 --> 09:50.480 In this case, it's in site 100. 190 09:50.480 --> 09:54.120 We see the protocol is set to use dtls. 191 09:54.120 --> 10:00.000 And we see the system IP in this case is 10 dot 255 dot 255 dot one. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 191 09:54.120 --> 10:00.000 And we see the system IP in this case is 10 dot 255 dot 255 dot one. 192 10:00.000 --> 10:03.470 Now if we were to scroll down through this, we'll see that there's a ton of 193 10:03.470 --> 10:04.560 other information 194 10:04.560 --> 10:05.560 here. 195 10:05.560 --> 10:07.640 We're not going to go over all of this right now. 196 10:07.640 --> 10:11.150 But as you can see, there's a lot of information here that we can use when we 197 10:11.150 --> 10:11.760 're trying to 198 10:11.760 --> 10:13.240 do troubleshooting. 199 10:13.240 --> 10:17.710 Now this bottom section, we can see gets a lot of wraparound because it's a 200 10:17.710 --> 10:18.720 very wide 201 10:18.720 --> 10:19.720 command. 202 10:19.720 --> 10:25.600 We're going to find that a lot of the CLI commands in SD when are this way. 203 10:25.600 --> 10:29.510 So just be aware, you may have to zoom out in order to be able to fully see 204 10:29.510 --> 10:30.120 this as it's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 204 10:29.510 --> 10:30.120 this as it's 205 10:30.120 --> 10:31.760 meant to be seen. 206 10:31.760 --> 10:34.360 And as you can see, this one is quite wide. 207 10:34.360 --> 10:37.300 So we have to zoom out quite a bit. 208 10:37.300 --> 10:41.280 So this might be a little small for you to actually read here in the video. 209 10:41.280 --> 10:45.560 But the important thing to note is this is giving us a lot of information about 210 10:45.560 --> 10:46.440 the outside 211 10:46.440 --> 10:47.720 interface. 212 10:47.720 --> 10:51.440 So we see which interface is being used for the outside. 213 10:51.440 --> 10:56.560 We see the public IP and the public port as well as the private IP address. 214 10:56.560 --> 11:00.480 Then we see that same information for IPV6. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 214 10:56.560 --> 11:00.480 Then we see that same information for IPV6. 215 11:00.480 --> 11:03.080 We see the color, which we mentioned had to be set. 216 11:03.080 --> 11:05.960 In this case, it's Biz internet. 217 11:05.960 --> 11:10.020 And then we see a lot more information out towards the end here as far as its 218 11:10.020 --> 11:10.560 current 219 11:10.560 --> 11:15.950 state and various other information about this connection out here towards the 220 11:15.950 --> 11:16.520 end. 221 11:16.520 --> 11:19.680 So again, very good command to keep handy. 222 11:19.680 --> 11:22.920 But again, fitting it all on the screen makes it a little hard to read. 223 11:22.920 --> 11:26.320 So let's go ahead and zoom back in here a little bit again. 224 11:26.320 --> 11:28.520 Now let's do our show clock. 225 11:28.520 --> 11:30.240 And again, this one's fairly straightforward. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 225 11:28.520 --> 11:30.240 And again, this one's fairly straightforward. 226 11:30.240 --> 11:34.120 It just tells us what the device thinks the current time is. 227 11:34.120 --> 11:38.840 And if that's not correct, we can use the clock set command. 228 11:38.840 --> 11:41.760 And as you can see here, simply once the current time and then it'll ask for 229 11:41.760 --> 11:42.280 the date 230 11:42.280 --> 11:43.480 and so on. 231 11:43.480 --> 11:48.240 So we can manually set this as well if we need to, if it's too far off. 232 11:48.240 --> 11:53.470 So those are some good commands for keeping an eye on our system information 233 11:53.470 --> 11:54.840 and our clock. 234 11:54.840 --> 12:04.760 [BLANK_AUDIO]