WEBVTT

1
00:00.000 --> 00:03.720
Hello and welcome. My name is Keith Barker.

2
00:03.720 --> 00:07.160
And in a previous skill, we walked through the process of setting up a policy-

3
00:07.160 --> 00:08.880
based IPsec VPN tunnel

4
00:08.880 --> 00:14.000
between a Tier 0 gateway in the world of NSX and a third-party external router.

5
00:14.000 --> 00:18.240
However, that is not the only option for setting up an IPsec-based site-to-site

6
00:18.240 --> 00:19.080
VPN tunnel.

7
00:19.080 --> 00:22.640
Another option is what's called a route-based VPN.

8
00:22.640 --> 00:26.020
And here's the big difference between those two types, policy-based and route-

9
00:26.020 --> 00:26.360
based.

10
00:26.360 --> 00:30.230
With policy-based, we're specifying in the session information the networks,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:26.360 --> 00:30.230
With policy-based, we're specifying in the session information the networks,

11
00:30.230 --> 00:32.160
the exact networks that we want to protect.

12
00:32.160 --> 00:34.880
For example, this network here, over to this network here.

13
00:34.880 --> 00:38.800
And by specifying what those networks are, that is our effective policy for our

14
00:38.800 --> 00:40.960
policy-based IPsec tunnel.

15
00:40.960 --> 00:45.960
So what is the other option? The other option is a route-based VPN with IPsec.

16
00:45.960 --> 00:50.210
And with a route-based IPsec VPN tunnel, the big difference is we now are going

17
00:50.210 --> 00:52.280
to have a logical network segment

18
00:52.280 --> 00:54.040
between the two sites.

19
00:54.040 --> 00:57.120
And then with that logical network statement, we can set up routings.

20
00:57.120 --> 01:01.240
So at any time the gateway needs to forward traffic over that logical IP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
00:57.120 --> 01:01.240
So at any time the gateway needs to forward traffic over that logical IP

21
01:01.240 --> 01:03.160
network between the two sites,

22
01:03.160 --> 01:05.120
that traffic automatically gets encrypted.

23
01:05.120 --> 01:10.370
So in the future, if we add two or three or a dozen routes at one site and a

24
01:10.370 --> 01:12.320
dozen or more routes at the other site,

25
01:12.320 --> 01:15.840
as long as those routes are believed to be reachable over that logical network

26
01:15.840 --> 01:17.160
between the two peers,

27
01:17.160 --> 01:19.120
all that traffic can be encrypted.

28
01:19.120 --> 01:24.330
So part of the magic for a route-based IPsec VPN tunnel is the creation through

29
01:24.330 --> 01:25.320
the IPsec session

30
01:25.320 --> 01:30.290
of a logical VTI, a virtual tunnel interface on each of the gateways that are
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
01:25.320 --> 01:30.290
of a logical VTI, a virtual tunnel interface on each of the gateways that are

31
01:30.290 --> 01:32.640
going to support this logical network segment

32
01:32.640 --> 01:34.440
between the two sites.

33
01:34.440 --> 01:35.480
And here's the great news.

34
01:35.480 --> 01:39.510
In this set of videos, I'd like to walk you through the logic of how that works

35
01:39.510 --> 01:39.760
.

36
01:39.760 --> 01:42.760
I'd like to put a game plan together with you to actually implement it.

37
01:42.760 --> 01:48.360
And then together, we'll follow that game plan to implement and verify an IPsec

38
01:48.360 --> 01:50.080
route-based VPN tunnel

39
01:50.080 --> 01:55.080
between two gateways to NSX gateways that are two different sites.

40
01:55.080 --> 01:56.760
So if you're ready, I'm ready.

41
01:56.760 --> 01:59.160
I'll see you in the very next video.