WEBVTT

1
00:00.000 --> 00:03.730
So one of our first steps in getting an IPSect tunnel up and working between

2
00:03.730 --> 00:09.110
these two endpoints is to make sure that this T0 gateway is connected to this

3
00:09.110 --> 00:14.180
external VLAN78 and that it has the edge IP addresses and virtual IP address

4
00:14.180 --> 00:16.000
associated with that external network.

5
00:16.000 --> 00:20.350
So let's make a road trip over to the NSX manager and let's put that external

6
00:20.350 --> 00:22.000
connectivity in place.

7
00:22.000 --> 00:26.080
So this is the interface for the NSX manager and because it's not being managed

8
00:26.080 --> 00:29.000
by a global manager, we can do all of our work right here.

9
00:29.000 --> 00:33.780
So to start off, let's go to networking and let's take a peek at the network
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:29.000 --> 00:33.780
So to start off, let's go to networking and let's take a peek at the network

10
00:33.780 --> 00:36.000
topology as it currently is.

11
00:36.000 --> 00:39.000
So I've got this red T0 gateway here.

12
00:39.000 --> 00:41.000
I've got a directly connected segment.

13
00:41.000 --> 00:45.280
We've got some VMs connected to it and I have some external interfaces on the

14
00:45.280 --> 00:47.000
10210 network.

15
00:47.000 --> 00:52.470
So what we need to do is create a new external segment for VLAN78 and then we

16
00:52.470 --> 00:56.220
'll add a couple new interfaces, one for edge one and one for edge two to

17
00:56.220 --> 00:58.000
connect to that new external VLANs.

18
00:58.000 --> 01:02.550
So to do that with the networking tab selected on top under connectivity on the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

18
00:58.000 --> 01:02.550
So to do that with the networking tab selected on top under connectivity on the

19
01:02.550 --> 01:08.250
left, we'll go down to segments and let's create a new external segment for V

20
01:08.250 --> 01:09.000
LAN78.

21
01:09.000 --> 01:12.000
So we'll click on add segment right there.

22
01:12.000 --> 01:17.190
We'll name this external VLAN78 and for the transport zone, let's grab our lab

23
01:17.190 --> 01:23.280
three red VLAN transport zone right there and we'll specify for the VLAN right

24
01:23.280 --> 01:26.000
here that it's VLAN78 and that's it.

25
01:26.000 --> 01:29.350
So we'll click on save and then for that segment, that's enough configuring for

26
01:29.350 --> 01:30.000
right now.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:30.000 --> 01:36.000
So we have this segment called external VLAN78 that is associated with VLAN78.

28
01:36.000 --> 01:39.940
Next, let's go to our tier zero gateway and specify that we want to use our two

29
01:39.940 --> 01:43.000
edge nodes to connect to that external network segment.

30
01:43.000 --> 01:46.000
So with networking still selected, we'll now click on tier zero gateways.

31
01:46.000 --> 01:49.000
Here is our red tier zero gateway.

32
01:49.000 --> 01:53.030
So to do that, we'll click on the three dots next to our red tier zero gateway

33
01:53.030 --> 01:54.000
and from the menu, we'll click on edit.

34
01:54.000 --> 01:57.120
So in edit mode here for the tier zero gateway, let me collapse the left hand

35
01:57.120 --> 01:58.000
side a little bit.

36
01:58.000 --> 02:00.000
We'll go down to the interfaces.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
02:00.000 --> 02:01.000
We currently have two.

38
02:01.000 --> 02:04.000
We'll click on that hyperlink and we'll add a couple more.

39
02:04.000 --> 02:07.000
Actually, before I do that, it looks like I have a typo right there.

40
02:07.000 --> 02:12.000
So this says E2 for edge two, VLAN81, 82, but the IP address is 62.

41
02:12.000 --> 02:15.000
I'm just going to edit that so the name matches.

42
02:15.000 --> 02:19.000
I'll click on edit and that really should say 62 in the name of that interface.

43
02:19.000 --> 02:21.000
So I'll correct that.

44
02:21.000 --> 02:24.000
Scroll down, click on save and then collapse that.

45
02:24.000 --> 02:25.000
That looks a lot better.

46
02:25.000 --> 02:29.940
So now with that update, let's create two new interfaces, both of them for VLAN

47
02:29.940 --> 02:31.000
78.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
02:29.940 --> 02:31.000
78.

48
02:31.000 --> 02:32.000
So we'll click on add interface.

49
02:32.000 --> 02:37.000
This will be for edge one, VLAN78 and the address we want to use on edge one

50
02:37.000 --> 02:40.000
for VLAN78 is .61.

51
02:40.000 --> 02:45.280
And we'll put in that IP address right now before we forget, which is 78.0.0.61

52
02:45.280 --> 02:46.000
with a 24-bit mask.

53
02:46.000 --> 02:51.000
And we're going to connect that over to the external VLAN78 just like that.

54
02:51.000 --> 02:53.000
And we want to use edge one for this.

55
02:53.000 --> 02:56.000
So we'll select edge one from our available edge nodes.

56
02:56.000 --> 02:57.000
And that looks great.

57
02:57.000 --> 03:01.680
So we'll scroll down, click on save and then we'll repeat that process for edge
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:57.000 --> 03:01.680
So we'll scroll down, click on save and then we'll repeat that process for edge

58
03:01.680 --> 03:04.000
two also on that 78 address space.

59
03:04.000 --> 03:06.000
So we'll click on add interface.

60
03:06.000 --> 03:10.000
This one we'll call E2 for edge two, VLAN78.62.

61
03:10.000 --> 03:15.000
And then over here we'll put in the IP address, which is 78.0.0.62 with a 24-

62
03:15.000 --> 03:15.000
bit mask.

63
03:15.000 --> 03:19.000
And then for the segment we're connecting to, that's the external VLAN78.

64
03:19.000 --> 03:22.480
And for the edge node, the only available edge node left is edge two right

65
03:22.480 --> 03:23.000
there.

66
03:23.000 --> 03:25.000
So we'll select it and that looks good.

67
03:25.000 --> 03:28.000
So we'll scroll down, click on save and let's check our work.

68
03:28.000 --> 03:32.000
So here is the first one and that is 780061.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
03:28.000 --> 03:32.000
So here is the first one and that is 780061.

69
03:32.000 --> 03:35.000
Here's the second one, 780062.

70
03:35.000 --> 03:36.000
That looks great.

71
03:36.000 --> 03:39.000
So we'll go ahead and close that and click here on close editing.

72
03:39.000 --> 03:43.000
And let's take a look at the topology by clicking here on network topology.

73
03:43.000 --> 03:47.360
So there are our four external interfaces too are on VLAN 21 based on the IP

74
03:47.360 --> 03:50.000
dressing and the ones on the outside here,

75
03:50.000 --> 03:55.000
the 780061 and 780062 are the ones that I just added.

76
03:55.000 --> 03:58.520
So to confirm basic connectivity to our gateway, we could go to our gateway

77
03:58.520 --> 04:02.000
itself and try to ping outbound from there on the 78 network
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
03:58.520 --> 04:02.000
itself and try to ping outbound from there on the 78 network

78
04:02.000 --> 04:06.000
or we could go to our top of rack switch and ping from there coming in.

79
04:06.000 --> 04:10.390
So before we test basic connectivity, let me verify that I have some IP address

80
04:10.390 --> 04:12.000
to ping to on my top of rack switch.

81
04:12.000 --> 04:14.000
So let me bring in that switch.

82
04:14.000 --> 04:15.000
Here it is.

83
04:15.000 --> 04:19.000
And let's do a show IP interface brief is a Cisco Kettle Switch.

84
04:19.000 --> 04:23.000
I'll say please exclude anything that has the word unsigned in it.

85
04:23.000 --> 04:24.000
All right.

86
04:24.000 --> 04:26.000
So on VLAN78, I do have an IP address.

87
04:26.000 --> 04:27.000
All right.

88
04:27.000 --> 04:30.000
So so we should be able to ping from our tier zero gateway.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
04:30.000 --> 04:36.000
This IP address 780099 because it's also in VLAN78 or we could also go ahead

90
04:36.000 --> 04:40.000
and ping from the switch right here down to those two addresses.

91
04:40.000 --> 04:41.000
Let's try that as well.

92
04:41.000 --> 04:44.000
Ping over to 78.0.0.61.

93
04:44.000 --> 04:48.000
It will do 780062 and that's working.

94
04:48.000 --> 04:49.000
That's great.

95
04:49.000 --> 04:51.000
And it's also tries actually we haven't set the virtual IP address.

96
04:51.000 --> 04:55.000
So that's going to fail until we get our virtual IP address set up.

97
04:55.000 --> 04:57.580
So let's go ahead and set up that virtual IP address and then we'll try that as

98
04:57.580 --> 04:58.000
well.

99
04:58.000 --> 05:02.230
So back to our tier zero gateway and then we'll edit our tier zero gateway and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
04:58.000 --> 05:02.230
So back to our tier zero gateway and then we'll edit our tier zero gateway and

100
05:02.230 --> 05:06.000
then for the HAVAP, we'll go ahead and click on the hyperlink there.

101
05:06.000 --> 05:08.000
And we've got one for the 21 network.

102
05:08.000 --> 05:11.440
Let's go ahead and add a VIP configuration and that IP address is going to be

103
05:11.440 --> 05:14.000
78.0.0.60 based on our plan.

104
05:14.000 --> 05:16.000
Let's check out our plan real quick.

105
05:16.000 --> 05:17.000
So we're right here.

106
05:17.000 --> 05:18.000
Sure enough.

107
05:18.000 --> 05:22.260
We want to use a virtual IP address of dot 60 on that 7800 network for the T

108
05:22.260 --> 05:23.000
zero gateway.

109
05:23.000 --> 05:25.000
And that's what we're setting up right now.

110
05:25.000 --> 05:28.000
So 780060 with a 24 bit mass that looks good.

111
05:28.000 --> 05:33.000
And then for the interfaces involved, we want the ones on the 78 network.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

111
05:28.000 --> 05:33.000
And then for the interfaces involved, we want the ones on the 78 network.

112
05:33.000 --> 05:37.000
So that's edge one on VLAN 78 and edge two on VLAN 78 perfect perfect.

113
05:37.000 --> 05:39.000
And then we'll click on add and that looks good.

114
05:39.000 --> 05:42.000
We'll click on apply, click on save.

115
05:42.000 --> 05:46.750
And now we should be able to ping that virtual IP address as well from the

116
05:46.750 --> 05:50.250
external switch and verify that here's the ping we tried just a moment ago and

117
05:50.250 --> 05:52.000
now for that same ping.

118
05:52.000 --> 05:53.000
No problem.

119
05:53.000 --> 05:54.000
We're good to go.

120
05:54.000 --> 05:58.230
That verifies connectivity from effectively our edge nodes on behalf of the

121
05:58.230 --> 06:01.000
tier zero gateway out to the physical network.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
05:58.230 --> 06:01.000
tier zero gateway out to the physical network.

122
06:01.000 --> 06:04.830
And if we want to verify it in the other direction as well, what we could do is

123
06:04.830 --> 06:08.000
let's go take a look at what our management IP addresses for our edge nodes.

124
06:08.000 --> 06:12.980
So to do that, let's close our editing first and then we'll click on system and

125
06:12.980 --> 06:16.000
on the left will open up fabric, click on nodes.

126
06:16.000 --> 06:20.000
And I seem to confirm what the IP addresses on node one.

127
06:20.000 --> 06:23.000
So node one right here to make go ahead and clean up some of the columns.

128
06:23.000 --> 06:26.000
I don't need that and I don't need that and I don't need that.

129
06:26.000 --> 06:30.000
So edge one is at 192.168.1.36.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

130
06:30.000 --> 06:33.000
Let's s is each over there and take a look from its perspective.

131
06:33.000 --> 06:36.000
So here we are connecting over to dot 36.

132
06:36.000 --> 06:37.000
That's edge one fantastic.

133
06:37.000 --> 06:40.000
Let's do a get gateways just to confirm what's there.

134
06:40.000 --> 06:44.000
So we here's our services and distributed router for red T zero.

135
06:44.000 --> 06:49.000
Let's go into VRF two by typing in VRF two, it's our services router.

136
06:49.000 --> 06:51.000
So you get route press center.

137
06:51.000 --> 06:55.000
So there's our directly connected T zero route 7800.

138
06:55.000 --> 06:58.870
And if you do a get forwarding, I also need to configure a route on this tier

139
06:58.870 --> 07:02.530
zero gateway to tell it, Hey, if you ever need to forward a packet over to the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

139
06:58.870 --> 07:02.530
zero gateway to tell it, Hey, if you ever need to forward a packet over to the

140
07:02.530 --> 07:07.100
1080 network address space, forward it over with the next top of my Cisco

141
07:07.100 --> 07:08.000
router.

142
07:08.000 --> 07:13.000
So if you look at the topology, that's going to be 7800 dot 10.

143
07:13.000 --> 07:17.120
So while we're at it right here, let's also set up a specific route going over

144
07:17.120 --> 07:19.000
to the 1080 network.

145
07:19.000 --> 07:22.510
So the tier zero gateway won't try to use this default route, which is going

146
07:22.510 --> 07:24.000
out a different interface.

147
07:24.000 --> 07:27.630
So even though we're doing policy based VPNs, don't ever forget that we still

148
07:27.630 --> 07:30.000
need routing in place for our traffic to flow.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
07:30.000 --> 07:33.710
So back at the NSX manager, if we go back to networking and then we go back to

150
07:33.710 --> 07:37.000
our tier zero gateways, we'll edit our existing tier zero gateway by clicking

151
07:37.000 --> 07:37.000
on the network.

152
07:37.000 --> 07:41.000
And we'll go down to the routing section right here.

153
07:41.000 --> 07:43.000
And we'll click on the link for static routes.

154
07:43.000 --> 07:46.000
So currently there's a default route that we saw at the command line.

155
07:46.000 --> 07:48.000
And we want to add one more.

156
07:48.000 --> 07:52.000
So this one is going to be route to Cisco subnet.

157
07:52.000 --> 07:58.000
And that subnet is the 10.8.0 network with a 24 bit mask.

158
07:58.000 --> 08:02.000
And the next hop is going to be our Cisco router address that's reachable.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

158
07:58.000 --> 08:02.000
And the next hop is going to be our Cisco router address that's reachable.

159
08:02.000 --> 08:08.540
And that is 78.0.0.10 and leave the 80 as one and click on add and click on

160
08:08.540 --> 08:13.530
apply and click on save and then click on close and scroll down, click on close

161
08:13.530 --> 08:14.000
editing.

162
08:14.000 --> 08:17.560
And since we have the command line open at our tier zero gateway, let's just

163
08:17.560 --> 08:20.000
verify that we have the route there as well.

164
08:20.000 --> 08:23.000
So here if we have the up arrow key and we do a get forwarding.

165
08:23.000 --> 08:27.190
Now we have a specific route for that 1080 network. We didn't have that a

166
08:27.190 --> 08:28.000
moment ago.

167
08:28.000 --> 08:31.990
So this is the output of get forwarding. We could also do a get route and that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

167
08:28.000 --> 08:31.990
So this is the output of get forwarding. We could also do a get route and that

168
08:31.990 --> 08:33.000
would also reveal that as well.

169
08:33.000 --> 08:39.000
So here is our static route for the 1080 network with the next top of 780010.

170
08:39.000 --> 08:43.000
So currently we have our T zero set up with this additional connection.

171
08:43.000 --> 08:46.000
Now we verified basic connectivity to the top of our switch.

172
08:46.000 --> 08:49.000
We added a static route to say, Hey, to get to the 1080 network.

173
08:49.000 --> 08:52.000
Your next top is this Cisco router.

174
08:52.000 --> 08:55.000
And there's actually one other thing I want to check and that is my NAT rule.

175
08:55.000 --> 08:55.640
So currently I've got NAT to allow this VM here to go out through the other

176
08:55.640 --> 09:01.000
service provider through VLAN 21.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

176
08:55.640 --> 09:01.000
service provider through VLAN 21.

177
09:01.000 --> 09:04.710
And I don't want to have any NAT applied for traffic from this VM as is going

178
09:04.710 --> 09:08.000
over the IP sec tunnel over to the Cisco router.

179
09:08.000 --> 09:12.000
So let's just double check the net rules and make sure we're not including NAT

180
09:12.000 --> 09:15.000
accidentally on the traffic that's supposed to go over the tunnel.

181
09:15.000 --> 09:19.240
So to verify that back at the NSX manager, we click on networking and then on

182
09:19.240 --> 09:20.000
the left go down to net.

183
09:20.000 --> 09:25.000
And here is our NAT rule. Let's take a look and sure enough, this says 10,

184
09:25.000 --> 09:25.000
anything.

185
09:25.000 --> 09:27.000
Go ahead and do this translation.

186
09:27.000 --> 09:30.740
So let me go ahead and edit that real quick and we'll add that net role and say
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

186
09:27.000 --> 09:30.740
So let me go ahead and edit that real quick and we'll add that net role and say

187
09:30.740 --> 09:31.000
, you know what?

188
09:31.000 --> 09:35.950
We only want this source net to apply if it's going through the two interfaces

189
09:35.950 --> 09:41.000
on VLAN 21 and not if that traffic is going through the VLAN 78 interfaces.

190
09:41.000 --> 09:45.350
So with those other two selected, we'll click on apply and scroll down, click

191
09:45.350 --> 09:46.000
on save.

192
09:46.000 --> 09:49.790
And now, NAT won't be applied for traffic from our VM if it's going over the

193
09:49.790 --> 09:52.000
VPN tunnel towards the Cisco router.

194
09:52.000 --> 09:55.000
Based on the static route that we put in a moment ago.

195
09:55.000 --> 09:58.720
So now that we have the basic connectivity to this extra segment that we're

196
09:58.720 --> 10:01.000
going to need for our IP sec tunnel,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

196
09:58.720 --> 10:01.000
going to need for our IP sec tunnel,

197
10:01.000 --> 10:05.390
in the next video, let's focus our attention on the configuration of this Cisco

198
10:05.390 --> 10:06.000
router.

199
10:06.000 --> 10:09.000
So we'll do that in the next video and I'll see you there in just a moment.