WEBVTT

1
00:00.000 --> 00:07.320
So before we get too much further into investigating our private cloud

2
00:07.320 --> 00:13.680
connectivity options, we do need to discuss how SD-WAN is going to separate the

3
00:13.680 --> 00:19.000
different paths going to different locations, or we also call them transports.

4
00:19.000 --> 00:24.980
The way we tell the difference is through something called transport locators,

5
00:24.980 --> 00:30.910
or T-locks. So in this video, we want to jump in and take a closer look at how
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

5
00:24.980 --> 00:30.910
or T-locks. So in this video, we want to jump in and take a closer look at how

6
00:30.910 --> 00:36.380
these work, what's contained in them, and a little bit about how we can

7
00:36.380 --> 00:37.000
separate paths.

8
00:37.000 --> 00:42.000
So let's go ahead and jump in and take a closer look.

9
00:42.000 --> 00:49.520
So as we often like to do, let's begin our discussion by asking what exactly is

10
00:49.520 --> 00:58.340
a transport locator or a T-lock. Well quite simply, a T-lock is the interface

11
00:58.340 --> 01:01.000
that's used by SD-WAN.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:58.340 --> 01:01.000
that's used by SD-WAN.

12
01:01.000 --> 01:09.060
This is what connects SD-WAN to the underlay network specifically through VPN

13
01:09.060 --> 01:16.000
zero. So this is the basis of forming the data plane for SD-WAN.

14
01:16.000 --> 01:23.060
Each of these T-locks has its own identification, and that identification

15
01:23.060 --> 01:31.020
includes things such as the SD-WAN routers system IP address, the WAN interface
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
01:23.060 --> 01:31.020
includes things such as the SD-WAN routers system IP address, the WAN interface

16
01:31.020 --> 01:35.430
color, and if you're not familiar with this, we'll be discussing this in more

17
01:35.430 --> 01:38.000
detail here in just a few moments.

18
01:38.000 --> 01:46.520
And the transport encapsulation, this would be for example, is it GRE, or IPsec

19
01:46.520 --> 01:52.000
. So the encapsulation is also included in the T-lock.

20
01:52.000 --> 02:02.010
Now these T-locks aren't going to do any good unless they're exchanged between
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
01:52.000 --> 02:02.010
Now these T-locks aren't going to do any good unless they're exchanged between

21
02:02.010 --> 02:04.650
the devices. So these T-locks, as well as the overlay prefixes, in other words,

22
02:04.650 --> 02:08.170
the routes themselves, as well as other information, such as interface

23
02:08.170 --> 02:14.410
statistics and such, are all exchanged using OMP, which we've mentioned a few

24
02:14.410 --> 02:16.000
times already.

25
02:16.000 --> 02:21.740
And as we mentioned, we then use these T-locks to establish the IPsec VPN

26
02:21.740 --> 02:26.000
tunnels, which of course makes up the data plane.

27
02:26.000 --> 02:31.970
Now another thing that these T-locks are responsible for is assisting with the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
02:26.000 --> 02:31.970
Now another thing that these T-locks are responsible for is assisting with the

28
02:31.970 --> 02:37.610
fact that routers and the controllers can sit behind NAT or network address

29
02:37.610 --> 02:39.000
translation.

30
02:39.000 --> 02:44.550
Now V-bond is what's responsible for this. So let's talk about how this works

31
02:44.550 --> 02:46.000
with the T-locks.

32
02:46.000 --> 02:53.520
First, V-bond will learn both the public and the private addresses for each

33
02:53.520 --> 03:00.000
device when that device authenticates to the V-bond server.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
03:00.000 --> 03:08.650
V-bond will then act as a session, traversal, utility, for NAT, or a STUN

35
03:08.650 --> 03:10.000
server.

36
03:10.000 --> 03:14.000
That means that it's coordinating all of the NAT translations.

37
03:14.000 --> 03:20.340
This is then what allows the devices to form that data plane, specifically

38
03:20.340 --> 03:25.000
again the IPsec tunnels, over these NAT sessions.

39
03:25.000 --> 03:29.650
For this we're going to need two different addresses of course. The first one,

40
03:29.650 --> 03:36.960
the pre NAT address, will be the address assigned to the WAN interface itself
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
03:29.650 --> 03:36.960
the pre NAT address, will be the address assigned to the WAN interface itself

41
03:36.960 --> 03:39.000
on the WAN edge device.

42
03:39.000 --> 03:44.620
Now interestingly, this can either be an actual public IP address or it can be

43
03:44.620 --> 03:49.000
an RFC 1918 address reserved for internal use.

44
03:49.000 --> 03:57.090
Then of course, we also have the post NAT address. This is the address that's

45
03:57.090 --> 04:03.000
actually seen by the V-bond server during that authentication process.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
03:57.090 --> 04:03.000
actually seen by the V-bond server during that authentication process.

46
04:03.000 --> 04:07.950
So when the authentication request comes in, it essentially just looks at the

47
04:07.950 --> 04:12.000
source address and that's what becomes the post NAT address.

48
04:12.000 --> 04:18.020
Now once again, this can either be a public address or an RFC 1918 address.

49
04:18.020 --> 04:22.000
There's no requirement on what type of addressing this needs to use.

50
04:22.000 --> 04:28.960
And in fact, if there is no NAT on the network, which is quite possible, then

51
04:28.960 --> 04:33.000
these addresses will simply be the same.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
04:28.960 --> 04:33.000
these addresses will simply be the same.

52
04:33.000 --> 04:38.880
And we won't be doing any of our STUN functionality. We won't be doing NAT

53
04:38.880 --> 04:44.000
traversal using our T-Locks and our V-bond server.

54
04:44.000 --> 04:51.340
Now another very important aspect of the T-Locks are their colors. T-Locks are

55
04:51.340 --> 04:58.000
simply keywords that are used to identify each WAN transport.

56
04:58.000 --> 05:03.500
And since they're used for identification, well then that means that every
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
04:58.000 --> 05:03.500
And since they're used for identification, well then that means that every

57
05:03.500 --> 05:07.000
single transport has to have a unique color.

58
05:07.000 --> 05:12.750
These colors can be classified as either public or private, and we'll talk

59
05:12.750 --> 05:18.000
about what that means as we go here, starting with our private colors.

60
05:18.000 --> 05:24.700
So what does that mean? Well, it means that there should be no NAT. These are

61
05:24.700 --> 05:30.000
basically inside connections and therefore they don't need to be NATted.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
05:30.000 --> 05:36.570
There are three colors reserved for this. The first one is Metro Ethernet. The

63
05:36.570 --> 05:44.070
second one is MPLS. And the last one is any label beginning private, and there

64
05:44.070 --> 05:49.000
are six of them that can be numbered one through six.

65
05:49.000 --> 05:54.730
Public colors are reserved for things that are using public IP addresses, and

66
05:54.730 --> 06:00.280
therefore may possibly have to traverse NAT. This is actually quite a list of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
05:54.730 --> 06:00.280
therefore may possibly have to traverse NAT. This is actually quite a list of

67
06:00.280 --> 06:01.000
colors.

68
06:01.000 --> 06:12.040
We have 3G, we have Biz Internet, we have Blue, we have Bronze, we have Custom.

69
06:12.040 --> 06:16.000
Again, there's three custom values, one through three.

70
06:16.000 --> 06:27.190
We just have one called default, Gold, Green, LTE, Public Internet, Red, and

71
06:27.190 --> 06:34.630
finally Silver. So again, quite a few colors available for public use, and then
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
06:27.190 --> 06:34.630
finally Silver. So again, quite a few colors available for public use, and then

72
06:34.630 --> 06:38.000
we have the three that are for private use.

73
06:38.000 --> 06:42.850
Now the really cool thing about these colors is not only can they be used as an

74
06:42.850 --> 06:48.600
identifier, which of course is what we've discussed so far, but we can also use

75
06:48.600 --> 06:56.080
this to control which devices actually form IP set tunnels with which other

76
06:56.080 --> 06:58.000
devices over which colors.

77
06:58.000 --> 07:03.400
So let's talk about that in a little more detail, because in the context of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
06:58.000 --> 07:03.400
So let's talk about that in a little more detail, because in the context of

78
07:03.400 --> 07:08.840
public Internet versus private cloud connectivity, this becomes really

79
07:08.840 --> 07:10.000
important.

80
07:10.000 --> 07:16.840
I can't have a public Internet interface on one router trying to form a tunnel

81
07:16.840 --> 07:21.000
with the private connection on the other router.

82
07:21.000 --> 07:26.020
Now ultimately, the worst that's going to happen is it's going to try to form

83
07:26.020 --> 07:30.000
that tunnel and it will be constantly in a form of failure.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
07:30.000 --> 07:35.420
That's not going to actually harm anything, but having tunnels that are trying

85
07:35.420 --> 07:40.000
to form and in a constant state of failure can be very undesirable.

86
07:40.000 --> 07:46.000
So let's take a look at how we can use colors to prevent that from happening.

87
07:46.000 --> 07:52.300
So as we just sort of inferred the default behavior of the way an edge devices

88
07:52.300 --> 07:59.100
is it will attempt and again may not be able to succeed, but it will attempt to

89
07:59.100 --> 08:06.000
form that IP set tunnel with every interface on a peer router from a different
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
07:59.100 --> 08:06.000
form that IP set tunnel with every interface on a peer router from a different

90
08:06.000 --> 08:07.000
site.

91
08:07.000 --> 08:10.850
Now, that's a lot of things to say, but of course, it's going to be in a

92
08:10.850 --> 08:15.650
different site. It's not going to try to form these tunnels automatically with

93
08:15.650 --> 08:18.000
redundant routers in the same site.

94
08:18.000 --> 08:22.400
And as we just mentioned in our call out, if we have something like this

95
08:22.400 --> 08:27.620
private connection that we're talking about and the public Internet, this is

96
08:27.620 --> 08:32.000
probably not even possible, let alone desirable.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
08:27.620 --> 08:32.000
probably not even possible, let alone desirable.

97
08:32.000 --> 08:36.730
We wouldn't want that connection to come up to begin with. So how do we

98
08:36.730 --> 08:42.000
actually solve this problem? And believe it or not, it's actually quite simple.

99
08:42.000 --> 08:48.840
While we're configuring this, we simply use the restrict keyword when we define

100
08:48.840 --> 08:55.730
the color and it will then prevent this from even attempting to form a tunnel

101
08:55.730 --> 08:58.000
with any other color.

102
08:58.000 --> 09:02.230
So that way we're going to use the colors to restrict which tunnels will
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
08:58.000 --> 09:02.230
So that way we're going to use the colors to restrict which tunnels will

103
09:02.230 --> 09:04.000
actually try to be formed.

104
09:04.000 --> 09:08.000
Let's take a look at this in the form of an example.

105
09:08.000 --> 09:15.000
Here we have an example where we have four different T locks, T1 through T4.

106
09:15.000 --> 09:20.000
T1 and T3 are green, T2 and T4 are gold.

107
09:20.000 --> 09:26.160
And the default behavior, as we can see, it's going to try to form all of these

108
09:26.160 --> 09:30.000
tunnels going to every single other device.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
09:30.000 --> 09:33.000
This is the part that we may or may not want.

110
09:33.000 --> 09:38.630
Now in this example, we're just sort of picturing it as Internet 1 and Internet

111
09:38.630 --> 09:39.000
2.

112
09:39.000 --> 09:43.430
And if this is just two different Internet connections to two different service

113
09:43.430 --> 09:47.000
providers for redundancy, this wouldn't really be a problem.

114
09:47.000 --> 09:49.000
All of these tunnels will form.

115
09:49.000 --> 09:55.820
If we look down here at the bottom, we see that all of our connections, T1 to T

116
09:55.820 --> 10:02.000
3, T1 to T4, T2 to T3, T2 to T4 are all successful.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
09:55.820 --> 10:02.000
3, T1 to T4, T2 to T3, T2 to T4 are all successful.

117
10:02.000 --> 10:06.000
All of these tunnels come up, everything's connected, everything's redundant.

118
10:06.000 --> 10:07.000
This is great.

119
10:07.000 --> 10:14.000
The problem comes in is if we cannot form these tunnels in the middle.

120
10:14.000 --> 10:18.000
What if there's no way to get from Internet 1 to Internet 2?

121
10:18.000 --> 10:23.000
Because maybe one of these is instead our private transport.

122
10:23.000 --> 10:26.000
This is where the colors can come in.

123
10:26.000 --> 10:32.900
In our second example, what we end up with is we put the word restrict on our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
10:26.000 --> 10:32.900
In our second example, what we end up with is we put the word restrict on our

124
10:32.900 --> 10:34.000
colors.

125
10:34.000 --> 10:40.280
So now the only thing that's going to be successful is the green to green and

126
10:40.280 --> 10:42.000
the gold to gold.

127
10:42.000 --> 10:48.000
So T1 to T3 makes a tunnel and T2 to T4 makes a tunnel.

128
10:48.000 --> 10:54.000
And again, in this example, we're using Internet 1 versus MPLS.

129
10:54.000 --> 10:59.460
But again, we could just as easily replace either Internet 1 or MPLS with a

130
10:59.460 --> 11:01.000
private connection.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

130
10:59.460 --> 11:01.000
private connection.

131
11:01.000 --> 11:06.000
It's all the same thing as just simply two different transports.

132
11:06.000 --> 11:12.000
So in this video, we got an introduction to transport locators or T-locks.

133
11:12.000 --> 11:18.300
We talked about how these function as a unique identifier for each transport

134
11:18.300 --> 11:23.000
and how they carry various attributes, including the color.

135
11:23.000 --> 11:29.030
We then also talked about how that color can be used to control which devices

136
11:29.030 --> 11:33.000
form IPsec tunnels with which other devices.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
11:29.030 --> 11:33.000
form IPsec tunnels with which other devices.

137
11:33.000 --> 11:38.040
This is of course very important because we may not always have communication

138
11:38.040 --> 11:43.150
between our different transports and therefore we would have tunnels trying to

139
11:43.150 --> 11:46.000
form that well, they just never can.

140
11:46.000 --> 11:51.550
So now that we have a better idea about how T-locks function, let's jump in and

141
11:51.550 --> 11:56.000
take a closer look at AWS Direct Connection.