WEBVTT

1
00:00.000 --> 00:04.470
In this video, we're going to configure and verify destination net in our top

2
00:04.470 --> 00:04.800
ology.

3
00:04.800 --> 00:08.600
And to do that, we're going to leverage this server right here at .13 on the 10

4
00:08.600 --> 00:09.680
10 Zero Network.

5
00:09.680 --> 00:13.280
And let's go ahead and map that to this globally-routable address, or at least

6
00:13.280 --> 00:14.240
in my lab environment,

7
00:14.240 --> 00:18.720
this globally-routable address. So that way, when an entity or user somewhere

8
00:18.720 --> 00:19.920
here on the outside of

9
00:19.920 --> 00:25.360
our gateway attempts to reach the 2312254 address, so I'll put that right here,

10
00:25.360 --> 00:28.800
23.1.2.2.54,

11
00:28.800 --> 00:34.960
we're going to map that over to the internal address of 10.10.0. And based on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:28.800 --> 00:34.960
we're going to map that over to the internal address of 10.10.0. And based on

12
00:34.960 --> 00:35.520
the IP address

13
00:35.520 --> 00:39.220
we have on that server right now, it's a .13. So on the initial flow of traffic

14
00:39.220 --> 00:40.080
, we're swapping

15
00:40.080 --> 00:43.880
out the destination address from this to this. And that's why it's called

16
00:43.880 --> 00:45.120
destination net. And

17
00:45.120 --> 00:49.100
then for the reply traffic from the server back to the client, this net device,

18
00:49.100 --> 00:50.000
our tier zero gateway,

19
00:50.000 --> 00:54.230
who did the initial destination net translation, will untranslate that packet

20
00:54.230 --> 00:54.960
and then put the

21
00:54.960 --> 00:58.010
original information back in. We're going to the IP addresses and forward it

22
00:58.010 --> 00:59.040
back out to the client.

23
00:59.040 --> 01:02.690
So as part of our process here, let's just take a moment and verify that our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:59.040 --> 01:02.690
So as part of our process here, let's just take a moment and verify that our

24
01:02.690 --> 01:03.760
server right here

25
01:03.760 --> 01:08.600
really is at 1010.0.13. And assuming it still is, we'll then proceed to put in

26
01:08.600 --> 01:09.360
our destination

27
01:09.360 --> 01:13.780
now. So this is my little server on segment 10 that we placed earlier. And it's

28
01:13.780 --> 01:14.800
IP address indeed

29
01:14.800 --> 01:20.870
is 1010.0.13. Also, what I'd like to do is modify the default webpage for this

30
01:20.870 --> 01:21.840
server. And that way,

31
01:21.840 --> 01:25.510
when we connect to this server, we can verify we're connected to actually this

32
01:25.510 --> 01:26.400
device right here.

33
01:26.400 --> 01:29.670
And just to verify that, I'm going to go ahead and connect on this local server

34
01:29.670 --> 01:30.960
to its own webpage.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
01:29.670 --> 01:30.960
to its own webpage.

35
01:30.960 --> 01:34.990
So they've got a bare bones browser right here. So we'll go ahead and launch

36
01:34.990 --> 01:35.920
that. And we'll go

37
01:35.920 --> 01:41.530
to 10.10.0.13 press enter. And sure enough, right there, this is our server at

38
01:41.530 --> 01:42.880
.13. So when we

39
01:42.880 --> 01:46.680
connect from a device that's external or outside of our gateway, and we connect

40
01:46.680 --> 01:47.680
to the globally mapped

41
01:47.680 --> 01:51.710
address, and it shows up at the server, that way we can confirm we're actually

42
01:51.710 --> 01:52.320
being mapped to the

43
01:52.320 --> 01:55.850
right server. All right, let me move that out of the way for a moment. And now

44
01:55.850 --> 01:56.720
that we have that

45
01:56.720 --> 02:01.650
server all set up here at .13, let's set up the destination at and map that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
01:56.720 --> 02:01.650
server all set up here at .13, let's set up the destination at and map that

46
02:01.650 --> 02:02.560
internal address of

47
02:02.560 --> 02:08.030
.13, so that when initially it's connected to on this external IP address, 2312

48
02:08.030 --> 02:09.440
24, the NAT device

49
02:09.440 --> 02:13.190
does destination at and redirects it down to the server right here. So to set

50
02:13.190 --> 02:14.480
up that additional

51
02:14.480 --> 02:18.080
destination NAT rule to do that, we go to networking right here in the NSX

52
02:18.080 --> 02:18.720
manager.

53
02:18.720 --> 02:22.950
And on the left, we'll go down to net under network services. So there's our

54
02:22.950 --> 02:23.760
source NAT,

55
02:23.760 --> 02:27.280
and we'll click on add to add a new rule. And this one, we're going to go ahead

56
02:27.280 --> 02:28.000
and make a

57
02:28.000 --> 02:31.710
destination NAT rule. So we'll call it for server. And then for the type of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:28.000 --> 02:31.710
destination NAT rule. So we'll call it for server. And then for the type of

58
02:31.710 --> 02:32.560
rule, it's going to be

59
02:32.560 --> 02:36.160
a destination NAT. And then for the source IP address, if we don't care where

60
02:36.160 --> 02:36.880
it's coming from,

61
02:36.880 --> 02:39.880
the initial source address, we can leave that blank. And then for the

62
02:39.880 --> 02:40.960
destination address,

63
02:40.960 --> 02:43.990
this is where we have specified the destination address of where they're trying

64
02:43.990 --> 02:44.480
to go to.

65
02:44.480 --> 02:51.170
So in our case, if they're going to 23.1.2.254, that actual IP address, then we

66
02:51.170 --> 02:52.080
want to swap out

67
02:52.080 --> 02:55.980
with destination NAT, that destination address, we want to use the address of

68
02:55.980 --> 02:58.320
10.10.0.13, which is

69
02:58.320 --> 03:02.220
the address of our server on the yellow segment. Then we click here on set and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
02:58.320 --> 03:02.220
the address of our server on the yellow segment. Then we click here on set and

70
03:02.220 --> 03:03.440
make sure it's applied

71
03:03.440 --> 03:08.490
for both of our interfaces, click on apply and click on save. And then it says

72
03:08.490 --> 03:09.680
here uninitialized,

73
03:09.680 --> 03:13.040
we'll go ahead and refresh that. That looks good. So here, if we click on the

74
03:13.040 --> 03:14.480
icon for the stats,

75
03:14.480 --> 03:18.260
that's right there, it's showing us no active sessions at the moment, no packet

76
03:18.260 --> 03:19.200
counts and no

77
03:19.200 --> 03:23.260
data. And that's because we have not yet matched on any traffic for this

78
03:23.260 --> 03:24.720
destination NAT rule.

79
03:24.720 --> 03:28.560
So we'll click on close there. And let's test this out. And this server,

80
03:28.560 --> 03:29.440
besides just running

81
03:29.440 --> 03:34.140
the web services that we configured, it also supports SSH. So we could go to a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
03:29.440 --> 03:34.140
the web services that we configured, it also supports SSH. So we could go to a

82
03:34.140 --> 03:34.800
device out here.

83
03:34.800 --> 03:38.790
In fact, we could go to .71, which has the little teeny web client that we just

84
03:38.790 --> 03:39.280
placed

85
03:39.280 --> 03:42.590
out there on that 23 network. And then from that device on 23 network, we could

86
03:42.590 --> 03:43.280
test out web

87
03:43.280 --> 03:48.260
connectivity, going to the global address here 231224 and verify it redirects

88
03:48.260 --> 03:49.600
us here to the server.

89
03:49.600 --> 03:54.000
We could also initiate an SSH session, which could also verify we're going to

90
03:54.000 --> 03:55.200
the right server as well.

91
03:55.200 --> 03:59.440
So let's do both. So to test this on the right hand side, I've got a client

92
03:59.440 --> 04:00.080
machine, and this is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
03:59.440 --> 04:00.080
machine, and this is

93
04:00.080 --> 04:05.190
on the 2312 network. It's a .71. And this can be our client. And then over here

94
04:05.190 --> 04:05.680
on the right,

95
04:05.680 --> 04:11.280
we have our actual server at 10 10 0 13 and it's running SSH services. So we

96
04:11.280 --> 04:12.240
should be able to

97
04:12.240 --> 04:17.470
issue or start an SSH session from here going to the globally mapped address,

98
04:17.470 --> 04:21.280
which is 23.1.2.254.

99
04:21.280 --> 04:24.670
And then gateway zero with this destination NAT should swap that over the

100
04:24.670 --> 04:26.000
destination address

101
04:26.000 --> 04:31.600
to the address of 10.10.0.13. And then forward it down to that IP address. And
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
04:26.000 --> 04:31.600
to the address of 10.10.0.13. And then forward it down to that IP address. And

102
04:31.600 --> 04:32.560
one of the easiest

103
04:32.560 --> 04:37.220
ways of verifying all that would be to simply do SH from here from the client

104
04:37.220 --> 04:38.160
to that IP address

105
04:38.160 --> 04:41.950
and verify we end up over here at the server. So over here on the right, let's

106
04:41.950 --> 04:42.560
go ahead and do an

107
04:42.560 --> 04:47.690
SSH space dash L and we'll log in as root. And we'll direct our SSH session

108
04:47.690 --> 04:48.880
towards the IP address

109
04:48.880 --> 04:55.590
23.1.2.254 and press enter. So it's asking us if we want to continue connecting

110
04:55.590 --> 04:56.480
. So that's a very

111
04:56.480 --> 04:59.920
good sign that is working. We'll type in yes. And it's asking me for the

112
04:59.920 --> 05:01.360
password on the server. So
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
04:59.920 --> 05:01.360
password on the server. So

113
05:01.360 --> 05:04.590
we'll go ahead and put the password in for root. We are connected to this IP

114
05:04.590 --> 05:06.960
address 23.1.2.254.

115
05:06.960 --> 05:12.620
But due to destination NAT, the gateway mapped that over to 10 10 0 13. So our

116
05:12.620 --> 05:13.440
SSH session is

117
05:13.440 --> 05:18.080
really connected to the destination address of 10 10 0 13. So we can verify

118
05:18.080 --> 05:18.880
that here through

119
05:18.880 --> 05:23.910
our SSH session by typing in if config for ethernet zero. And this is showing

120
05:23.910 --> 05:25.440
us the IP address because

121
05:25.440 --> 05:30.010
in the context of this SSH session, it's as if we're sitting at the server over
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
05:25.440 --> 05:30.010
in the context of this SSH session, it's as if we're sitting at the server over

122
05:30.010 --> 05:30.720
on the left.

123
05:30.720 --> 05:34.710
Also at the server on the left, if we did a who to see who's connected to us.

124
05:34.710 --> 05:35.040
So here shows

125
05:35.040 --> 05:38.240
we have two connections and they are both for me. So I did one a while back

126
05:38.240 --> 05:39.280
just to verify I could

127
05:39.280 --> 05:42.670
get connectivity. And then I turned on the camera and recorded this one. So

128
05:42.670 --> 05:43.760
this address right here

129
05:43.760 --> 05:48.880
23.1.2.71 is the source address on the client on the right hand side that we're

130
05:48.880 --> 05:49.920
connecting from.

131
05:49.920 --> 05:54.300
So using SSH is just a convenient way to not only confirm that NAT is working,

132
05:54.300 --> 05:55.120
but also to verify

133
05:55.120 --> 05:58.960
the IP addresses that are involved for that translation. Also back here in the

134
05:58.960 --> 05:59.600
NSX manager,

135
05:59.600 --> 06:03.200
if we go to networking and then on the left, we get it on to NAT. Here's our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

135
05:59.600 --> 06:03.200
if we go to networking and then on the left, we get it on to NAT. Here's our

136
06:03.200 --> 06:03.920
NAT rules. I'll

137
06:03.920 --> 06:07.120
collapse that on the left gives a little more room. So for this destination net

138
06:07.120 --> 06:08.480
rule for the server

139
06:08.480 --> 06:12.030
over here. Now if we click on statistics, little like on there, it's now

140
06:12.030 --> 06:13.280
showing us how many active

141
06:13.280 --> 06:16.970
sessions we have, the packet counts involved and how much data has gone over

142
06:16.970 --> 06:18.160
that translation.

143
06:18.160 --> 06:21.760
So these are the stats for the destination net rule and for the source net that

144
06:21.760 --> 06:22.640
we did earlier,

145
06:22.640 --> 06:26.560
if we click there on the statistics, here's the counts for there as well. So

146
06:26.560 --> 06:27.680
based on our game plan,

147
06:27.680 --> 06:32.860
I think we are done with the core content for this skill. We updated our top
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

147
06:27.680 --> 06:32.860
I think we are done with the core content for this skill. We updated our top

148
06:32.860 --> 06:33.360
ology,

149
06:33.360 --> 06:38.950
use the 23 network and the VLAN 23. We deployed a couple new VMs for testing.

150
06:38.950 --> 06:39.920
We set up source net

151
06:39.920 --> 06:44.720
for outbound traffic. We set up destination for the benefit of incoming traffic

152
06:44.720 --> 06:45.040
and being able to

153
06:45.040 --> 06:48.880
reach a specific server on the inside. And also to help validate and reinforce

154
06:48.880 --> 06:49.680
what we've learned

155
06:49.680 --> 06:53.590
in this set of videos. In the next video, I'd like to pose a little challenge

156
06:53.590 --> 06:54.720
regarding NAT.

157
06:54.720 --> 06:57.830
So when you're ready, I'll see you in that next video as we validate our

158
06:57.830 --> 06:59.680
knowledge together.