WEBVTT

1
00:00.000 --> 00:04.710
In a previous set of videos and in a previous skill, we looked at IPsec site

2
00:04.710 --> 00:06.120
site VPN tunnels

3
00:06.120 --> 00:07.960
that were policy-based.

4
00:07.960 --> 00:13.060
And the example we used there was a T0 gateway building an IPsec tunnel over to

5
00:13.060 --> 00:13.760
a third-party

6
00:13.760 --> 00:14.760
device.

7
00:14.760 --> 00:18.480
And in that previous skill, we were connecting over to a Cisco router.

8
00:18.480 --> 00:22.160
And certainly a policy-based IPsec site-to-site tunnel is one of our options.

9
00:22.160 --> 00:27.450
However, if we are connecting one site with gateways as part of NSX to another

10
00:27.450 --> 00:28.040
site with

11
00:28.040 --> 00:30.000
gateways as part of NSX.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:30.000 --> 00:34.160
One of those options is an IPsec route-based site-to-site VPN.

13
00:34.160 --> 00:35.560
And let's take a look at the concept.

14
00:35.560 --> 00:39.860
So here we have, for example, a cloud that could represent a public network or

15
00:39.860 --> 00:40.760
the internet.

16
00:40.760 --> 00:44.800
And over here at site three, we have a T0 gateway with some edge nodes.

17
00:44.800 --> 00:46.760
And let's imagine we're using this address right here.

18
00:46.760 --> 00:51.520
23.1.2.30 as the virtual IP address supported by the edges.

19
00:51.520 --> 00:56.560
And over here at site four, we have the address 24.1.2.40, which once again is

20
00:56.560 --> 00:57.520
being supported

21
00:57.520 --> 00:58.840
by the edge nodes.

22
00:58.840 --> 01:02.360
So if we have that connectivity to the internet using these respective IP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

22
00:58.840 --> 01:02.360
So if we have that connectivity to the internet using these respective IP

23
01:02.360 --> 01:03.360
addresses, and we

24
01:03.360 --> 01:06.860
can reach those two IP addresses that are being used by the T0 gateway's

25
01:06.860 --> 01:07.760
respectively,

26
01:07.760 --> 01:10.440
what we could do is we could leverage that connectivity.

27
01:10.440 --> 01:14.680
And on top of that, build an IPsec site-to-site route-based VPN.

28
01:14.680 --> 01:18.730
And one of the key differences between a route-based VPN and a policy-based VPN

29
01:18.730 --> 01:19.560
is that with a

30
01:19.560 --> 01:24.870
route-based VPN, we have a logical network between the two sites with the IPsec

31
01:24.870 --> 01:25.480
tunnel.

32
01:25.480 --> 01:30.080
And that's using a VTI virtual tunnel endpoint as the interface on each side
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

32
01:25.480 --> 01:30.080
And that's using a VTI virtual tunnel endpoint as the interface on each side

33
01:30.080 --> 01:31.440
for that connectivity.

34
01:31.440 --> 01:35.500
So although the edges just have this one global address 23.1.2.30 they're

35
01:35.500 --> 01:36.480
supporting, behind

36
01:36.480 --> 01:38.640
the scenes they can also support a VTI.

37
01:38.640 --> 01:42.010
So let's imagine for this virtual tunnel interface, we'll go ahead and use the

38
01:42.010 --> 01:42.640
addressing

39
01:42.640 --> 01:49.440
space of 10.0.34.34.0 with a 24-bit mask.

40
01:49.440 --> 01:53.640
And we can use private RFC 1918 addresses here because the actual IP address

41
01:53.640 --> 01:54.640
being used

42
01:54.640 --> 01:58.090
on this virtual tunnel interface, on this network segment here between the two

43
01:58.090 --> 01:58.600
sites,

44
01:58.600 --> 02:02.660
that is all going to be encrypted and encapsulated as the traffic is being sent
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
01:58.600 --> 02:02.660
that is all going to be encrypted and encapsulated as the traffic is being sent

45
02:02.660 --> 02:03.520
back and forth

46
02:03.520 --> 02:08.720
with IPsec between the address 23.1.2.30 and 24.1.2.40.

47
02:08.720 --> 02:11.320
And with IPsec behind the scenes, we're also going to have a couple of tunnels

48
02:11.320 --> 02:11.680
where we

49
02:11.680 --> 02:14.840
have the initial tunnel, which I'll go ahead and call the Ike tunnel.

50
02:14.840 --> 02:17.770
And that's the tunnel that the endpoints are going to use to communicate back

51
02:17.770 --> 02:18.200
and forth

52
02:18.200 --> 02:20.360
as they're communicating directly with each other.

53
02:20.360 --> 02:23.860
And then we're also going to have associate with that at IPsec Security

54
02:23.860 --> 02:24.960
Association, fondly

55
02:24.960 --> 02:26.920
called the IPsec tunnel.

56
02:26.920 --> 02:30.600
And in our previous skill regarding setting up policy-based VPNs, we took a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
02:26.920 --> 02:30.600
And in our previous skill regarding setting up policy-based VPNs, we took a

57
02:30.600 --> 02:31.320
closer look

58
02:31.320 --> 02:32.720
at those two tunnels.

59
02:32.720 --> 02:36.280
So if you need a refresher on why we have these two tunnels involved as part of

60
02:36.280 --> 02:36.800
IPsec,

61
02:36.800 --> 02:39.040
please feel free to check out that previous skill.

62
02:39.040 --> 02:43.100
And unlike policy-based IPsec VPN tunnels, where we're specifying, for example,

63
02:43.100 --> 02:43.400
over

64
02:43.400 --> 02:47.210
here at site three, that traffic from 10.33, going over to 10.44, should be

65
02:47.210 --> 02:47.760
encrypted and

66
02:47.760 --> 02:52.300
vice versa with route-based VPNs, anything that's sent over this 10.34, 34

67
02:52.300 --> 02:53.640
network here,

68
02:53.640 --> 02:56.240
that's being supported by the VTI's on both sides.

69
02:56.240 --> 03:00.080
Any traffic that goes across is going to be encrypted, leveraging the IPsec
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
02:56.240 --> 03:00.080
Any traffic that goes across is going to be encrypted, leveraging the IPsec

70
03:00.080 --> 03:00.640
tunnel.

71
03:00.640 --> 03:04.520
So as part of our configuration, not only do we want to set up the route-based

72
03:04.520 --> 03:05.040
VPNs with

73
03:05.040 --> 03:09.100
the logical tunnel interfaces with an IP dressing structure between those two

74
03:09.100 --> 03:09.720
sites, but we

75
03:09.720 --> 03:13.220
also want to make sure we set up routing so that if we want traffic, for

76
03:13.220 --> 03:14.040
example, from

77
03:14.040 --> 03:18.880
the 10.33 network here, that's going over to the 10.44 network here and vice

78
03:18.880 --> 03:19.480
versa, we

79
03:19.480 --> 03:23.280
want to logically send that traffic over the VTI interfaces.

80
03:23.280 --> 03:25.850
And when we do that, which causes the traffic then to go with this logical

81
03:25.850 --> 03:26.760
tunnel, any traffic

82
03:26.760 --> 03:30.440
over that tunnel will automatically be encrypted by the IPsec tunnel.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

82
03:26.760 --> 03:30.440
over that tunnel will automatically be encrypted by the IPsec tunnel.

83
03:30.440 --> 03:33.640
So once we have our routing set up correctly, and traffic logically is going

84
03:33.640 --> 03:35.360
over this 10.34,

85
03:35.360 --> 03:38.560
34 network between the networks over here at site three and the networks over

86
03:38.560 --> 03:38.840
here at

87
03:38.840 --> 03:42.330
site four, because it's going over the tunnel, any tunnel traffic is going to

88
03:42.330 --> 03:43.040
be encrypted

89
03:43.040 --> 03:44.800
and protected with IPsec.

90
03:44.800 --> 03:47.040
So as far as the routing goes, we have a few options.

91
03:47.040 --> 03:51.450
One is we could do static routing on each of the sites, or we could use border

92
03:51.450 --> 03:51.960
gateway

93
03:51.960 --> 03:56.000
protocol and specify that we want to share and advertise routes.

94
03:56.000 --> 04:00.200
And either way, either with static routes or dynamically learned routes via BGP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
03:56.000 --> 04:00.200
And either way, either with static routes or dynamically learned routes via BGP

95
04:00.200 --> 04:00.480
, the

96
04:00.480 --> 04:04.410
goal is that we train the gateways to use this logical segment, this 10.34, 10.

97
04:04.410 --> 04:05.280
34 network

98
04:05.280 --> 04:08.440
for any communications where we want to protect the traffic.

99
04:08.440 --> 04:12.640
And another benefit of a site to site VPN tunnel is that we do not have to do

100
04:12.640 --> 04:14.160
NAT on that traffic.

101
04:14.160 --> 04:16.860
Because from the perspective of this network right here, all they're going to

102
04:16.860 --> 04:17.440
see is traffic

103
04:17.440 --> 04:22.420
coming from into this routable IP address 23, 1, 230, and this routable address

104
04:22.420 --> 04:23.040
24, 1,

105
04:23.040 --> 04:24.080
240.

106
04:24.080 --> 04:27.880
And all the payload they'll see across the internet is encrypted traffic.

107
04:27.880 --> 04:30.940
When behind the scenes, that traffic shows up at the respective edges, they'll
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
04:27.880 --> 04:30.940
When behind the scenes, that traffic shows up at the respective edges, they'll

108
04:30.940 --> 04:31.240
do the

109
04:31.240 --> 04:34.560
decryption, and then they'll forward it down to the final destination.

110
04:34.560 --> 04:37.850
And just to reconfirm the big differences between a policy-based VPN and a

111
04:37.850 --> 04:39.440
route-based VPN is

112
04:39.440 --> 04:43.780
that the route-based VPN, we have this new logical network between the two

113
04:43.780 --> 04:44.480
sites that

114
04:44.480 --> 04:46.760
we're going to use as part of IPsec.

115
04:46.760 --> 04:51.460
And in a policy-based IPsec VPN tunnel, we do not have that logical network

116
04:51.460 --> 04:52.680
between them.

117
04:52.680 --> 04:56.510
But instead, we have policies that say if traffic is coming from 10, 330 and

118
04:56.510 --> 04:57.000
going to

119
04:57.000 --> 05:02.060
10, 40, 40, then go ahead and forward it over to the peer who then decrypt it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
04:57.000 --> 05:02.060
10, 40, 40, then go ahead and forward it over to the peer who then decrypt it

120
05:02.060 --> 05:02.640
without

121
05:02.640 --> 05:06.880
the use of a logical IP network segment between those two sites.

122
05:06.880 --> 05:09.990
So in this skill and instead of videos, we're going to focus on route-based VPN

123
05:09.990 --> 05:10.360
s.

124
05:10.360 --> 05:15.530
Now, to implement the IPsec route-based VPNs between two different sites, one

125
05:15.530 --> 05:16.280
of the key

126
05:16.280 --> 05:20.360
ingredients for success is to have a really concise game plan and have

127
05:20.360 --> 05:21.760
everything documented

128
05:21.760 --> 05:25.760
regarding what's in place and also what we want to accomplish.

129
05:25.760 --> 05:29.880
So in that light, join me in the next video as we put a very specific game plan

130
05:29.880 --> 05:30.520
together
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

130
05:29.880 --> 05:30.520
together

131
05:30.520 --> 05:36.170
to build and create IPsec route-based VPNs between site three and another NSX

132
05:36.170 --> 05:37.240
environment

133
05:37.240 --> 05:38.280
over at site four.

134
05:38.280 --> 05:47.360
[BLANK_AUDIO]