WEBVTT

1
00:00.000 --> 00:03.320
So it is time for us to implement based on our plan,

2
00:03.320 --> 00:06.520
SourceNet, which again is doing the initial translation

3
00:06.520 --> 00:09.480
of the source address, again, on the initial flow of traffic.

4
00:09.480 --> 00:12.760
So let's go ahead and take this VM here at 1010.0.10.

5
00:12.760 --> 00:13.880
That's VM1.

6
00:13.880 --> 00:17.000
And as his traffic goes out to the internet right here

7
00:17.000 --> 00:19.920
at our gateway zero, we want to implement SourceNet

8
00:19.920 --> 00:20.840
based on our plan.

9
00:20.840 --> 00:24.320
And our plan is this, any traffic sourced from 1010.0,

10
00:24.320 --> 00:28.080
anything, so the last octet could be 10 or 11, et cetera.

11
00:28.080 --> 00:32.720
We want to map it to an IP address in the pool of 2312151
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:28.080 --> 00:32.720
We want to map it to an IP address in the pool of 2312151

12
00:32.720 --> 00:34.120
through 250.

13
00:34.120 --> 00:36.680
So prior to doing that, let's head over to this VM1

14
00:36.680 --> 00:39.280
for a moment and just verify that prior to doing

15
00:39.280 --> 00:42.320
network address translation, it cannot get out to the internet.

16
00:42.320 --> 00:45.800
So we're at 1010.0.10 on VM1.

17
00:45.800 --> 00:48.640
So first thing we're going to do is verify that that is true.

18
00:48.640 --> 00:52.440
So we'll type in IF config for ethernet zero, press enter.

19
00:52.440 --> 00:54.760
And sure enough, it's at 1010.0.10.

20
00:54.760 --> 00:56.720
And we'll also type in route, just to make sure

21
00:56.720 --> 00:59.000
we have a correct default gateway, which we do.

22
00:59.000 --> 01:04.400
And let's do a ping, request to a trace out to 8.8.8.8.8.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

22
00:59.000 --> 01:04.400
And let's do a ping, request to a trace out to 8.8.8.8.8.

23
01:04.400 --> 01:08.040
Animated partway, so it made it at the first top of 1010.0.1.

24
01:08.040 --> 01:11.680
And then it made it to 1064.0.0, which is the gateway connectivity

25
01:11.680 --> 01:14.960
between gateway A and the tier zero gateway.

26
01:14.960 --> 01:16.440
And then it didn't get past that.

27
01:16.440 --> 01:19.280
And we have a little exclamation marks and ends implementing.

28
01:19.280 --> 01:20.960
There was a problem, didn't make it.

29
01:20.960 --> 01:24.600
So if we did a ping to 888, that's going to be no good as well.

30
01:24.600 --> 01:26.280
So we'll do a control C there.

31
01:26.280 --> 01:30.200
However, if we do a ping to our router up at 23.1.2.1,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
01:26.280 --> 01:30.200
However, if we do a ping to our router up at 23.1.2.1,

32
01:30.200 --> 01:32.760
and press enter, because it has routes back to us.

33
01:32.760 --> 01:33.800
And we have a route to it.

34
01:33.800 --> 01:35.440
We are able to do pings back and forth.

35
01:35.440 --> 01:37.000
So so far, no internet access.

36
01:37.000 --> 01:39.560
That's because we don't have correct NAT set up,

37
01:39.560 --> 01:41.880
source NAT set up for this flow of traffic.

38
01:41.880 --> 01:44.680
And so based on our plan, we are going to implement a NAT rule.

39
01:44.680 --> 01:46.720
And we're going to do it on our gateway zero.

40
01:46.720 --> 01:48.360
So to implement the NAT rules, we'll

41
01:48.360 --> 01:50.400
go to networking here in NSX.

42
01:50.400 --> 01:53.640
On the left, under network services, we'll click on NAT.

43
01:53.640 --> 01:55.320
So for our NAT rules, here we have

44
01:55.320 --> 01:57.400
options of where, first of all, do you want to have the NAT rules?

45
01:57.400 --> 01:58.120
On which gateway?

46
01:58.120 --> 02:00.840
So based on our plan, we want our NAT rules
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

46
01:58.120 --> 02:00.840
So based on our plan, we want our NAT rules

47
02:00.840 --> 02:02.560
to be on our tier zero gateway.

48
02:02.560 --> 02:04.480
So with that selected first, then we'll

49
02:04.480 --> 02:06.480
click right here on add NAT rule.

50
02:06.480 --> 02:07.640
Let me collapse the left-hand side.

51
02:07.640 --> 02:09.000
It gives a little more room.

52
02:09.000 --> 02:11.160
And so for our NAT rule, our source NAT rule,

53
02:11.160 --> 02:14.200
we want to match on traffic source, coming in from 10, 10,

54
02:14.200 --> 02:17.320
zero, anything, and then swap it out with an IP address

55
02:17.320 --> 02:18.680
from this pool right here.

56
02:18.680 --> 02:20.080
And when we configure this NAT rule,

57
02:20.080 --> 02:21.560
we have other options that we can specify.

58
02:21.560 --> 02:23.040
We could also specify, for example,

59
02:23.040 --> 02:25.760
that we only want the source NAT if the traffic is trying

60
02:25.760 --> 02:28.840
to go to a certain destination and other considerations

61
02:28.840 --> 02:30.040
or what porch are involved.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:28.840 --> 02:30.040
or what porch are involved.

62
02:30.040 --> 02:33.440
But for our plan, we just want any traffic source from 10, 10,

63
02:33.440 --> 02:36.440
zero to be mapped to one of these IP addresses

64
02:36.440 --> 02:39.840
in this range right here, as it goes through T0 on that initial

65
02:39.840 --> 02:41.680
flow of traffic going out to the internet.

66
02:41.680 --> 02:44.040
So I'm going to go ahead and call this 10.10,

67
02:44.040 --> 02:44.720
SNAT.

68
02:44.720 --> 02:47.240
And this little icon here is part of my password management

69
02:47.240 --> 02:49.680
system, so it's not actually part of the NSX.

70
02:49.680 --> 02:52.280
So there's the name for this new NAT rule,

71
02:52.280 --> 02:54.360
and we want to use source NAT.

72
02:54.360 --> 02:55.840
So if we want to do destination NAT,

73
02:55.840 --> 02:57.360
which we will in the next video,

74
02:57.360 --> 02:58.880
we choose that option right there.

75
02:58.880 --> 03:02.600
Or if we had active edges, we'd go ahead and choose reflexive.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
02:58.880 --> 03:02.600
Or if we had active edges, we'd go ahead and choose reflexive.

76
03:02.600 --> 03:04.760
Or if we want to set the specific rules to exempt

77
03:04.760 --> 03:06.240
some traffic flows from NAT,

78
03:06.240 --> 03:08.200
we'd go ahead and use the no options right here.

79
03:08.200 --> 03:10.560
So now we want to do a source NAT rule.

80
03:10.560 --> 03:12.120
And here it's asking us for the source IP.

81
03:12.120 --> 03:15.480
So you don't have to put in a range or a specific source IP

82
03:15.480 --> 03:16.120
address.

83
03:16.120 --> 03:18.520
If you don't, it's going to consider any traffic based

84
03:18.520 --> 03:21.680
on its routing tables that's going into the gateway.

85
03:21.680 --> 03:24.400
It's going to consider that a valid candidate to be translated.

86
03:24.400 --> 03:27.360
So in our lab environment, I want to go ahead and only

87
03:27.360 --> 03:32.960
apply source NAT if the source is coming from the range 10.10.0.0.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
03:27.360 --> 03:32.960
apply source NAT if the source is coming from the range 10.10.0.0.

88
03:32.960 --> 03:35.680
And that's the 24-bit mask, meaning any IP addresses

89
03:35.680 --> 03:38.080
that have the initial source address of 10.10.0,

90
03:38.080 --> 03:39.680
they're going to qualify for NATting,

91
03:39.680 --> 03:41.320
regardless of where they're going to.

92
03:41.320 --> 03:42.640
So the internet's a big place.

93
03:42.640 --> 03:44.360
I'm not going to make that conditional here.

94
03:44.360 --> 03:46.480
And then what IP address or addresses

95
03:46.480 --> 03:48.000
do we want to translate them into?

96
03:48.000 --> 03:50.160
And that's right here, the translated IP in port.

97
03:50.160 --> 03:52.840
So I'll go ahead for the IP address based on our plan.

98
03:52.840 --> 03:59.880
It is 23.1.2.151 through 23.1.2.250.

99
03:59.880 --> 04:01.640
Again, that's based on our plan.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
03:59.880 --> 04:01.640
Again, that's based on our plan.

100
04:01.640 --> 04:03.000
And then furthermore, we could also

101
04:03.000 --> 04:06.000
do port address translation for that traffic.

102
04:06.000 --> 04:07.640
And if we needed to or wanted to,

103
04:07.640 --> 04:11.520
we could also specify the actual service, or AKA port,

104
04:11.520 --> 04:13.080
that we want to use for that translation.

105
04:13.080 --> 04:15.640
But in this case, I just want to do a layer three swap out

106
04:15.640 --> 04:18.720
of the source address coming from 10.10.0 that are going

107
04:18.720 --> 04:20.680
through the gateway based on the routing table.

108
04:20.680 --> 04:22.280
And we're going to swap with that source address

109
04:22.280 --> 04:23.200
with one of these addresses.

110
04:23.200 --> 04:25.120
And everything else that layer four and above

111
04:25.120 --> 04:27.120
with our one-to-one mapping will leave alone.

112
04:27.120 --> 04:29.160
And as far as where we want to apply this to,

113
04:29.160 --> 04:29.960
it's not required.

114
04:29.960 --> 04:31.640
But if you want to granularly say,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

114
04:29.960 --> 04:31.640
But if you want to granularly say,

115
04:31.640 --> 04:32.040
you know what?

116
04:32.040 --> 04:36.400
I only want that applicable on this edge node or that edge node.

117
04:36.400 --> 04:38.640
You could go ahead and somebody select the ones you want.

118
04:38.640 --> 04:40.720
Or we could leave it blank and not set up a limit.

119
04:40.720 --> 04:42.840
That way it's going to apply to both of the interfaces.

120
04:42.840 --> 04:45.480
And then we'll scroll down and we'll click on Save.

121
04:45.480 --> 04:48.680
And it says NAT rule 10.10 SNAT successfully.

122
04:48.680 --> 04:52.680
So it successfully added our 10.10 source NAT rule.

123
04:52.680 --> 04:55.120
If we expand it here, it'll show us the details.

124
04:55.120 --> 04:58.960
Traffic from 10.10.0, as it's being routed through the gateway,

125
04:58.960 --> 05:00.720
in this case, gateway zero, is going
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

125
04:58.960 --> 05:00.720
in this case, gateway zero, is going

126
05:00.720 --> 05:03.440
to be swapped out with a source address in this range.

127
05:03.440 --> 05:06.160
So currently we have no active sessions, no packet counts,

128
05:06.160 --> 05:07.000
no data.

129
05:07.000 --> 05:10.320
And that's because we're not using that rule yet.