WEBVTT

1
00:00.000 --> 00:04.610
So as a test, let's go to VM1 and let's do a ping or a trace or some other

2
00:04.610 --> 00:08.510
traffic out to the internet at which point as that traffic is going through or

3
00:08.510 --> 00:13.000
tier zero gateway, it should swap out of the source address from the 10 10 zero

4
00:13.000 --> 00:17.000
in this case, 10 10 10 10 to one of these IP addresses in the pool.

5
00:17.000 --> 00:20.840
So here we are at VM1, let's just verify real quick at IP address, we'll do

6
00:20.840 --> 00:24.740
that with an IFCN FIG, it's also verified surrounding people with a route and

7
00:24.740 --> 00:28.000
sure enough it's default gateway is 10 10 zero one.

8
00:28.000 --> 00:35.470
So let's try a ping out to eight, eight, eight to eight, and that's supposed to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

8
00:28.000 --> 00:35.470
So let's try a ping out to eight, eight, eight to eight, and that's supposed to

9
00:35.470 --> 00:36.000
work.

10
00:36.000 --> 00:48.000
So now we enter the troubleshooting phase of our program. So let's do this, let

11
00:48.000 --> 00:48.000
's see if we can ping from this VM to this VM right here, which is the one at 70

12
00:48.000 --> 00:48.000
.

13
00:48.000 --> 00:51.320
And that way we can just alleviate the internet and routing there as one of our

14
00:51.320 --> 00:55.600
variables. So if we're able to ping from VM1 to this address, because this

15
00:55.600 --> 01:00.330
address has a default gateway going out to the internet, if the net is working,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:55.600 --> 01:00.330
address has a default gateway going out to the internet, if the net is working,

16
01:00.330 --> 01:01.000
this VM will think

17
01:01.000 --> 01:05.160
that packet came in from the 23 address space should respond back to it, at

18
01:05.160 --> 01:08.740
which point this tier zero gateway can untranslate the response and send it

19
01:08.740 --> 01:10.000
back to our client.

20
01:10.000 --> 01:16.340
So let's do a quick test by pinging 70 from VM1. So here at VM1 will do a ping

21
01:16.340 --> 01:24.150
to 23.1.2.70 and that is working. So we've just reduced the fault domain. So

22
01:24.150 --> 01:27.560
actually before I, we troubleshoot the rest of it, let's go ahead and do a

23
01:27.560 --> 01:28.000
consistent

24
01:28.000 --> 01:31.520
error and let's look at our stats for Nat. So back in our NSX manager under
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
01:28.000 --> 01:31.520
error and let's look at our stats for Nat. So back in our NSX manager under

25
01:31.520 --> 01:35.230
networking and with Nat selected, if we scroll to the right here, here's our

26
01:35.230 --> 01:39.000
net rule. There's our icon right there for statistics. We'll click there.

27
01:39.000 --> 01:43.120
And sure enough, we have an active session, 72 packets, if we click on refresh,

28
01:43.120 --> 01:47.230
because that ping is still happening in the background, that packet count and

29
01:47.230 --> 01:51.000
the data count should be increasing and they are fantastic.

30
01:51.000 --> 01:54.130
So another way of a confirmation that Nat is actually working right here at

31
01:54.130 --> 01:57.310
Gateway zero, let's troubleshoot why this VM can't get out all the way to the

32
01:57.310 --> 02:02.020
Internet. And to do that, let me go to our edge one, which is the active device
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

32
01:57.310 --> 02:02.020
Internet. And to do that, let me go to our edge one, which is the active device

33
02:02.020 --> 02:04.000
that's supporting that gateway functionality.

34
02:04.000 --> 02:08.630
And let's just verify that from the VRF for the services router that we can get

35
02:08.630 --> 02:13.350
up to the Internet and that will verify our routing from the perspective of the

36
02:13.350 --> 02:15.000
tier zero gateway itself.

37
02:15.000 --> 02:18.040
Because if the tier zero gateway can't get out to the Internet, no clients who

38
02:18.040 --> 02:21.140
are going through that gateway are going to be able to get there as well. So

39
02:21.140 --> 02:25.000
here we are once again with an SSH connection over to edge one.

40
02:25.000 --> 02:30.290
And let's do a get gateways. And there's our services router, VRF six, soul
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
02:25.000 --> 02:30.290
And let's do a get gateways. And there's our services router, VRF six, soul

41
02:30.290 --> 02:35.000
type in VRF six, and we'll get route. And oh yeah.

42
02:35.000 --> 02:39.340
I swear we looked at this earlier, we had an OSPF learned route, a default

43
02:39.340 --> 02:43.820
route that pointed to the next top and it is no longer here. So instead of

44
02:43.820 --> 02:48.120
troubleshooting the external router and saying why it's no longer advertising a

45
02:48.120 --> 02:49.000
default route.

46
02:49.000 --> 02:53.010
Here's what I propose we do. Let's just tell our T zero gateway that we want to

47
02:53.010 --> 02:58.000
have a static default route using the next top of 23.1.2.1.

48
02:58.000 --> 03:01.610
So we'll do that right now. We'll just tell the tier zero gateway that we want
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
02:58.000 --> 03:01.610
So we'll do that right now. We'll just tell the tier zero gateway that we want

49
03:01.610 --> 03:06.000
a static default route using dot one on the 23.1.2 network as the next top.

50
03:06.000 --> 03:10.090
So to do that, we'll go to our tier zero gateway right there and we'll edit it

51
03:10.090 --> 03:14.440
by clicking on the three dots for a tier zero gateway, click on edit, and then

52
03:14.440 --> 03:18.000
we'll scroll down under routing, open that up, and then for a step.

53
03:18.000 --> 03:22.090
Oh, static routes. And then for our static route. Oh, I've got an existing

54
03:22.090 --> 03:24.000
static route and it's got the wrong next top.

55
03:24.000 --> 03:29.000
So maybe we was just confused because it can no longer reach that IP address.

56
03:29.000 --> 03:32.160
Hmm. All right. So let's go ahead and fix this. Let's go ahead and click on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
03:29.000 --> 03:32.160
Hmm. All right. So let's go ahead and fix this. Let's go ahead and click on

57
03:32.160 --> 03:33.000
close on there.

58
03:33.000 --> 03:36.320
And let's just edit our default route. So we'll click on edit and then for the

59
03:36.320 --> 03:39.830
next top, we'll simply edit that as well. Click on edit and the next top is

60
03:39.830 --> 03:42.000
going to be for the default route.

61
03:42.000 --> 03:50.220
And that looks great. Click on add and apply and save and close and close. And

62
03:50.220 --> 03:55.000
just to confirm that that really took and now has a correct default route.

63
03:55.000 --> 03:58.640
Let's go back to the CLI. So here at the CLI will hit the upper key for get

64
03:58.640 --> 04:02.000
route and we should have a static route. Sure enough right there.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
03:58.640 --> 04:02.000
route and we should have a static route. Sure enough right there.

65
04:02.000 --> 04:07.110
This says the next top for that default static route is 23121 and if and if the

66
04:07.110 --> 04:12.450
OSPF learned route comes back for some reason, it'll have a better AD of 110

67
04:12.450 --> 04:17.000
and it should replace the static route with the OSPF learned route.

68
04:17.000 --> 04:19.710
Should that return? All right. So instead of having to troubleshoot my external

69
04:19.710 --> 04:22.000
router, we're simply going to use this static default route.

70
04:22.000 --> 04:25.480
So now that we have a working default route here at the gateway, let's go back

71
04:25.480 --> 04:28.600
to VM one and see whether or not we can make it all the way out to the Internet

72
04:28.600 --> 04:29.000
.

73
04:29.000 --> 04:33.430
All right. So here we are back at VM number one and let's go into a ping out to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
04:29.000 --> 04:33.430
All right. So here we are back at VM number one and let's go into a ping out to

74
04:33.430 --> 04:38.860
888 and survey says that is working fantastic. We could also do a trace route

75
04:38.860 --> 04:43.000
out to 888 just to verify we're going through the path we think we are.

76
04:43.000 --> 04:46.500
We're not going to some loop back address or something else locally in my lab

77
04:46.500 --> 04:48.000
network. All right. That looks good.

78
04:48.000 --> 04:48.040
Another cool test would be to go ahead and use SSH from VM one connected this

79
04:48.040 --> 04:54.780
little VM on VLAN 23 and that way we could also confirm what IP address it

80
04:54.780 --> 05:01.000
looks like we're coming from when we connect to the dot 70.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
04:54.780 --> 05:01.000
looks like we're coming from when we connect to the dot 70.

81
05:01.000 --> 05:04.930
So let's go to VM one. Let's open up an SSH session over to dot 70 and then we

82
05:04.930 --> 05:09.000
can from the perspective of dot 70 see who it looks like we're coming from.

83
05:09.000 --> 05:13.060
So it should appear even though we're really coming from 10 10 0 10. It should

84
05:13.060 --> 05:16.210
look like we're coming from some IP address in this range here based on the

85
05:16.210 --> 05:17.000
source net.

86
05:17.000 --> 05:22.000
So here is VM one right here. Let me make this a little bit bigger. Fantastic.

87
05:22.000 --> 05:25.510
We'll just do an I have config for ethernet zero is just to confirm that we're

88
05:25.510 --> 05:27.000
still on the right device.

89
05:27.000 --> 05:33.770
We are 10 10 0 10 and let's do an SSH dash L for login as root. And let's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
05:27.000 --> 05:33.770
We are 10 10 0 10 and let's do an SSH dash L for login as root. And let's

90
05:33.770 --> 05:38.000
connect up to 23 dot 1 dot 2 dot 70 and press enter.

91
05:38.000 --> 05:41.990
So saying do we want this is a very good sign by the way. So we'll say yes, we

92
05:41.990 --> 05:45.640
want to continue and then we'll supply the password and press enter and that's

93
05:45.640 --> 05:47.000
not the right password.

94
05:47.000 --> 05:52.580
So I'll try that again. Fantastic. So now we are connected logically from this

95
05:52.580 --> 05:58.200
little VM here via SSH up to dot 70. So up here if we did I have config, we're

96
05:58.200 --> 06:02.000
now logically sitting at dot 70 here showing us that that's the IP address
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
05:58.200 --> 06:02.000
now logically sitting at dot 70 here showing us that that's the IP address

97
06:02.000 --> 06:02.000
again.

98
06:02.000 --> 06:05.880
This is SSH from here to here looking at it from this perspective right here

99
06:05.880 --> 06:10.000
from dot 70. So another way to verify that would be to type in who.

100
06:10.000 --> 06:14.260
Oh, and that's not showing us the IP address. You know what? Let me pop up a

101
06:14.260 --> 06:19.480
another VM here up on this 23 network and that will show us exactly who we were

102
06:19.480 --> 06:21.000
connecting from.

103
06:21.000 --> 06:24.350
And that way we can verify it from here as well. So give me a moment. I'll pop

104
06:24.350 --> 06:27.600
in another VM right there with a different flavor of Linux so that can show us

105
06:27.600 --> 06:29.000
the incoming connections.

106
06:29.000 --> 06:32.130
In fact, I'll walk you through it so you can see every step along the way. So
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
06:29.000 --> 06:32.130
In fact, I'll walk you through it so you can see every step along the way. So

107
06:32.130 --> 06:35.840
let me go ahead to the data center right click and we'll deploy a new OVF

108
06:35.840 --> 06:38.000
template for my local file system.

109
06:38.000 --> 06:43.780
Click on upload files. I'll select the DSL OVA again. Click on next and we'll

110
06:43.780 --> 06:48.440
call this one second VM on 23. And then I'll put this in the same folder VMs

111
06:48.440 --> 06:49.000
for testing. Click on next.

112
06:49.000 --> 06:53.080
I'll also put this on a host on my management cluster. Let's put them on ESXIC.

113
06:53.080 --> 06:57.000
Click on next. I'll put it in the folder called VMs for testing. Click on next.

114
06:57.000 --> 07:00.000
I'll put it on ESXIC and the management cluster. Click on next.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
07:00.000 --> 07:03.000
And again, we'll give credit where credit is due for this really small VM.

116
07:03.000 --> 07:07.310
Fantastic. We'll click on next. I'll go ahead and choose the local data store

117
07:07.310 --> 07:08.000
on ESXIC. Click on next.

118
07:08.000 --> 07:12.290
And then I want to put this on the VLAN 23 port group which will put this VM

119
07:12.290 --> 07:17.860
connected to network 23.1.2. And there's DHCP services there. We'll click on

120
07:17.860 --> 07:19.000
next and finish.

121
07:19.000 --> 07:22.740
Then we'll give that a moment to go ahead and deploy. We'll look at recent

122
07:22.740 --> 07:27.000
tasks and it is on its way. All right. Super small VM. So it is almost done.

123
07:27.000 --> 07:30.600
And it is done. So we'll go ahead and power on that VM. Click OK. And then we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
07:27.000 --> 07:30.600
And it is done. So we'll go ahead and power on that VM. Click OK. And then we

124
07:30.600 --> 07:36.000
'll open up a remote console to it. So here's that second VM upon my 23 network

125
07:36.000 --> 07:37.000
that's now initializing.

126
07:37.000 --> 07:41.350
That's looking good. Let's verify its IP address. So this IP address right here

127
07:41.350 --> 07:46.320
is 23.1.2.71. And I just want to make sure that SSH services are running. So if

128
07:46.320 --> 07:51.720
we issued an SSH session from a client down here on the 1010 network and we

129
07:51.720 --> 07:56.000
connected up to this new server at .71 on this flavor of Linux.

130
07:56.000 --> 07:59.550
If we do a who it'll show us exactly the source IP address of where that

131
07:59.550 --> 08:03.560
incoming session is. All right. So here we go. This is the little VM one
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
07:59.550 --> 08:03.560
incoming session is. All right. So here we go. This is the little VM one

132
08:03.560 --> 08:07.510
machine right here. So I've just opened up an SSH session logging in his route

133
08:07.510 --> 08:12.480
to 23.1.2.71. And I'll say, yes, I want to continue. It's asking me for the

134
08:12.480 --> 08:14.000
password, which I will supply.

135
08:14.000 --> 08:19.200
So now we're logically connected via an SSH session from VM one at 10 10 0 10

136
08:19.200 --> 08:23.760
up to the second machine. Here on the 23 network at .71. So there's the address

137
08:23.760 --> 08:28.070
that we connected to right there. And if we do a who now on this system is

138
08:28.070 --> 08:33.970
showing that we're connected from 23.1.2.155. That's the translated address
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

138
08:28.070 --> 08:33.970
showing that we're connected from 23.1.2.155. That's the translated address

139
08:33.970 --> 08:36.000
that we implemented right here at the gateway.

140
08:36.000 --> 08:39.660
And my attention here is to confirm that the actual network address translation

141
08:39.660 --> 08:43.210
is really working. So if we typed in exit and we just close that connection to

142
08:43.210 --> 08:48.000
.71. Then we do a ping, for example, out to the Internet to 888 that should

143
08:48.000 --> 08:48.000
also work.

144
08:48.000 --> 08:53.140
And all of that traffic as it goes to our gateway zero is being translated. So

145
08:53.140 --> 08:57.550
go ahead and stop that ping. Let me minimize these remote consoles. And we can

146
08:57.550 --> 09:00.000
check that off our list as well regarding source net.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

147
09:00.000 --> 09:03.720
Now our next video, what I like to do is do destination net. And that's again

148
09:03.720 --> 09:07.820
where we're going to swap out on the initial flow of traffic. The destination

149
09:07.820 --> 09:12.010
IP address and a good use case for that would be if we have users, for example,

150
09:12.010 --> 09:17.190
out here on the outside of our net device who want to get to a server or some

151
09:17.190 --> 09:20.000
other device internally that has a private RFC 19 18 address.

152
09:20.000 --> 09:24.140
So to facilitate that from the outside coming to a private address, we can use

153
09:24.140 --> 09:28.390
destination net and that's exactly what we get to do in the next video. So I'll

154
09:28.390 --> 09:30.000
see you there in just a minute.