WEBVTT

1
00:00.000 --> 00:04.880
So for this challenge where this client right here can't access that IP address

2
00:04.880 --> 00:10.000
108010 which should be protected based on the IP sectonal setup whenever

3
00:10.000 --> 00:13.460
possible troubleshooting is a great idea to verify the symptoms that the

4
00:13.460 --> 00:15.000
customer is claiming.

5
00:15.000 --> 00:17.000
So let's take a moment and go to this VM.

6
00:17.000 --> 00:21.020
Let's do a quick ping over to 108010 to verify whether or not we have

7
00:21.020 --> 00:22.000
connectivity.

8
00:22.000 --> 00:25.410
So let's make sure the client is up and running and connected to the right

9
00:25.410 --> 00:28.000
segments. This is red one. That's the VM. There's a site.

10
00:28.000 --> 00:36.000
Pdres 10330151. This also indicates it's connected to the red segment 33 and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:28.000 --> 00:36.000
Pdres 10330151. This also indicates it's connected to the red segment 33 and

11
00:36.000 --> 00:38.000
just to confirm red.

12
00:38.000 --> 00:42.610
So 33 is our NSX based segment. So let's bring over our client. In fact, let's

13
00:42.610 --> 00:44.000
go ahead and open up a web console.

14
00:44.000 --> 00:47.820
That way it'll be a little bit bigger. So here's the web console for red one as

15
00:47.820 --> 00:50.000
shown up here in the top left hand corner.

16
00:50.000 --> 00:54.820
And if we do an IF config for ethernet zero being confirm it's IP address with

17
00:54.820 --> 00:59.000
a pin route space dash and that confirms the routing tables.

18
00:59.000 --> 01:03.730
We have a default route of 103301. So let's try to pin our default gateway 10.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

18
00:59.000 --> 01:03.730
We have a default route of 103301. So let's try to pin our default gateway 10.

19
01:03.730 --> 01:07.000
33.0.1. And that works.

20
01:07.000 --> 01:09.720
I think in the topology I might have had dot 60 there as an address that we

21
01:09.720 --> 01:13.000
could use, but it appears the dot one gateway is working.

22
01:13.000 --> 01:16.620
And let's also confirm that indeed is our address. So back in the NSX manager,

23
01:16.620 --> 01:19.000
we'll go to networking and we'll go to segments.

24
01:19.000 --> 01:25.000
There's our red, say 33 and sure enough 103301. So we can ping that address.

25
01:25.000 --> 01:29.000
Let's go ahead and also try to see if we can ping over to 10, 8, 0, 10.

26
01:29.000 --> 01:34.970
So we'll do a ping over to 10 dot 8 dot 0 dot 10 and survey says. Yep, that is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
01:29.000 --> 01:34.970
So we'll do a ping over to 10 dot 8 dot 0 dot 10 and survey says. Yep, that is

27
01:34.970 --> 01:40.000
not flying. So we'll do a control C and we had five out of five that failed.

28
01:40.000 --> 01:43.830
So from the client's perspective, it could go ahead and reach his default

29
01:43.830 --> 01:46.000
gateway, but it can't ping over here.

30
01:46.000 --> 01:50.620
So let's go ahead and take a look at the details for the IP sec tunnel going

31
01:50.620 --> 01:53.000
between gateway zero and the router.

32
01:53.000 --> 01:58.000
So back at the NSX manager with networking selected, we'll click on VPN and let

33
01:58.000 --> 02:00.000
's go to IP sec sessions.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
02:00.000 --> 02:04.090
And sure enough that says down right there if we open up the details here

35
02:04.090 --> 02:07.000
showing the local end point 780060.

36
02:07.000 --> 02:10.390
And that's the virtual IP address for the tier zero gateway and that external

37
02:10.390 --> 02:11.000
segment.

38
02:11.000 --> 02:15.910
And the other end of the tunnel is 708010. And that all looks good based on our

39
02:15.910 --> 02:17.000
configuration.

40
02:17.000 --> 02:23.000
Let's go take a look at the router and verify its IP address is really 708010.

41
02:23.000 --> 02:26.580
So at the router, if we do a commands, we can see what the actual IP addresses

42
02:26.580 --> 02:29.000
are. Here's one of those show IP interface brief.

43
02:29.000 --> 02:35.840
And here's the interfacing question 870010 that looks close. That's not the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

43
02:29.000 --> 02:35.840
And here's the interfacing question 870010 that looks close. That's not the

44
02:35.840 --> 02:37.000
right IP address.

45
02:37.000 --> 02:40.000
Let's take a look at our configuration in the NSX manager.

46
02:40.000 --> 02:44.000
So here in the NSX manager, we are supposed to be appearing with 708010.

47
02:44.000 --> 02:47.840
And if those two devices are on the same segment, the same VLAN, which they are

48
02:47.840 --> 02:50.000
, they need to have a common network address space.

49
02:50.000 --> 02:54.000
So it appears the Cisco routers off by a couple of digits there.

50
02:54.000 --> 02:58.000
It should be 708010 and not 870010.

51
02:58.000 --> 03:01.650
So back at the router, let's go ahead and fix that. So I'll go back into the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
02:58.000 --> 03:01.650
So back at the router, let's go ahead and fix that. So I'll go back into the

52
03:01.650 --> 03:06.000
interface for gigabit ethernet 0/0.78.

53
03:06.000 --> 03:10.600
And then an interface configuration mode will put in the right address of 78.0.

54
03:10.600 --> 03:12.000
0.10 with a 24-bit mask.

55
03:12.000 --> 03:17.420
Instead of the erroneous 87, then we'll go ahead and do a shutdown and give

56
03:17.420 --> 03:19.000
that a moment and a no shutdown.

57
03:19.000 --> 03:27.190
And let's go ahead and verify with a quick ping that we can reach 78.0.0.60,

58
03:27.190 --> 03:30.000
which is the virtual IP address over at Gateway 0.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
03:30.000 --> 03:34.080
So if that works, which it does, at least now we have the right IP address, let

60
03:34.080 --> 03:35.000
's see if there's any other problems.

61
03:35.000 --> 03:41.040
So back at the NSX manager, let me go ahead and do a refresh here. And that is

62
03:41.040 --> 03:42.000
now up.

63
03:42.000 --> 03:45.600
So that appears to have been the problem. Let's go back to our client and just

64
03:45.600 --> 03:47.000
verify that we can ping.

65
03:47.000 --> 03:50.420
So that ping test is going to go from this VM here over to an IP address over

66
03:50.420 --> 03:52.000
in a 1080 network.

67
03:52.000 --> 03:56.000
And we use .10. That's a loopback address I have set up on the external router.

68
03:56.000 --> 04:01.000
So let's bring in our client. And last time we tried to ping, it did not work.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
03:56.000 --> 04:01.000
So let's bring in our client. And last time we tried to ping, it did not work.

69
04:01.000 --> 04:05.720
Let's go ahead and try it again, 108010 and survey says that looks a lot better

70
04:05.720 --> 04:06.000
.

71
04:06.000 --> 04:11.000
So now it's working and let's go verify the hit counts in the NSX interface.

72
04:11.000 --> 04:16.080
So back at the NSX manager under the VPN section here with IPsec sessions tab

73
04:16.080 --> 04:19.000
selected, let's click right here on view statistics.

74
04:19.000 --> 04:22.430
And sure enough, not only is the tunnel up, but we also are showing packets

75
04:22.430 --> 04:23.000
going across.

76
04:23.000 --> 04:26.720
So that's another confirmation that the tunnel is up. Now another really cool

77
04:26.720 --> 04:30.000
feature is this option right here under IPsec sessions.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
04:30.000 --> 04:32.910
Go to the session you want to look at. There's an option for download config

79
04:32.910 --> 04:34.000
and check this out.

80
04:34.000 --> 04:39.130
This is a great way for troubleshooting to get a one stop shop look at how the

81
04:39.130 --> 04:42.000
VPN is configured in the NSX manager.

82
04:42.000 --> 04:46.000
So if you click here on download config and then yes, it just downloaded that

83
04:46.000 --> 04:48.000
to my downloads folder on my management computer.

84
04:48.000 --> 04:53.000
And here it is. So here is the session name IPsec session to Cisco.

85
04:53.000 --> 04:57.360
If we scroll down, it's showing us the details for the control tunnel, the Ike

86
04:57.360 --> 04:59.000
version one tunnel that we set up,

87
04:59.000 --> 05:03.540
including the method for authentication, the pre shared key we're using, the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
04:59.000 --> 05:03.540
including the method for authentication, the pre shared key we're using, the

88
05:03.540 --> 05:07.000
hashing, the encryption and the lifetime and the Diffie elm and group.

89
05:07.000 --> 05:09.980
And if we scroll down, it has details regarding the profile we use for the IP

90
05:09.980 --> 05:11.000
sec tunnel as well.

91
05:11.000 --> 05:16.480
So we're using ESP, which is protocol 50. We're using shot to 56. There's our

92
05:16.480 --> 05:17.000
lifetime.

93
05:17.000 --> 05:20.000
There's the encryption algorithm and we're not using PFS.

94
05:20.000 --> 05:23.390
And then we have a dead peer detection we took by default, which was checking

95
05:23.390 --> 05:25.000
every 60 seconds.

96
05:25.000 --> 05:30.140
And here it has the local and remote peer ID. So the local side is 70, 8060 and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
05:25.000 --> 05:30.140
And here it has the local and remote peer ID. So the local side is 70, 8060 and

97
05:30.140 --> 05:35.000
the remote side is 78, 0010, which on the router a few moments ago, it had been

98
05:35.000 --> 05:36.000
misconfigured.

99
05:36.000 --> 05:39.430
And that's why we couldn't build the tunnel. And as far as protected networks

100
05:39.430 --> 05:42.130
for our policy based IPsec tunnel, here are the two network and rest spaces

101
05:42.130 --> 05:43.000
that we're protecting.

102
05:43.000 --> 05:47.310
So from the perspective of the tier zero gateway is traffic from the 10, eight

103
05:47.310 --> 05:51.000
zero network that's going to the 10, 33, zero network.

104
05:51.000 --> 05:54.860
And the flip side of that is any traffic coming in from the other side, it's

105
05:54.860 --> 05:57.000
expecting that traffic to be encrypted.

106
05:57.000 --> 06:00.300
So it'll go through the process of decrypting the traffic that's coming in over
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
05:57.000 --> 06:00.300
So it'll go through the process of decrypting the traffic that's coming in over

107
06:00.300 --> 06:02.000
the tunnel from the external router.

108
06:02.000 --> 06:06.640
So thanks for joining me in this set of videos and the skill regarding IPsec

109
06:06.640 --> 06:09.000
site site tunnels in the world of NSX.

110
06:09.000 --> 06:13.000
And I look forward to seeing you my friend in another skill very, very soon.

111
06:13.000 --> 06:17.270
Until then, I hope this has been informative and I'd like to thank you for

112
06:17.270 --> 06:18.000
viewing.