WEBVTT

1
00:00.000 --> 00:03.680
All right, so for our game plan for IPsec route-based VPNs

2
00:03.680 --> 00:06.880
between two tier zero gateways at two different sites,

3
00:06.880 --> 00:09.360
one of our first steps is gonna be to validate

4
00:09.360 --> 00:12.120
our existing topology and configuration

5
00:12.120 --> 00:14.640
just to make sure we have these addresses involved

6
00:14.640 --> 00:16.680
to begin with and that the VMs

7
00:16.680 --> 00:19.360
that those respective sites can get out to the internet.

8
00:19.360 --> 00:22.040
So our first step will be to validate our existing topology

9
00:22.040 --> 00:24.560
just to make sure we know what we currently have in place.

10
00:24.560 --> 00:26.440
Then as far as our configuration goes,

11
00:26.440 --> 00:29.200
we then wanna go ahead and configure all the details

12
00:29.200 --> 00:31.080
that we need here at site three
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:29.200 --> 00:31.080
that we need here at site three

13
00:31.080 --> 00:33.880
for the route-based IPsec VPN tunnel

14
00:33.880 --> 00:35.680
we wanna create over to site four.

15
00:35.680 --> 00:38.120
So over here we'll say site three.

16
00:38.120 --> 00:38.980
And as part of that,

17
00:38.980 --> 00:41.640
if we don't have a VPN service currently enabled

18
00:41.640 --> 00:44.640
with our tier zero gateway, we'll need to create one.

19
00:44.640 --> 00:46.360
And based on our previous skill

20
00:46.360 --> 00:49.320
where we did an IPsec policy-based VPN

21
00:49.320 --> 00:52.360
between this tier zero and an external router.

22
00:52.360 --> 00:54.320
And in that previous set of videos,

23
00:54.320 --> 00:57.120
we did the tunnel out to a third party Cisco router.

24
00:57.120 --> 01:00.280
So the T zero here at site three already has a VPN service,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:57.120 --> 01:00.280
So the T zero here at site three already has a VPN service,

25
01:00.280 --> 01:03.240
but what it does not have is a VPN session

26
01:03.240 --> 01:05.880
that is gonna be used to connect over to site four.

27
01:05.880 --> 01:07.860
So we'll use the existing VPN service

28
01:07.860 --> 01:10.920
and we'll create a brand new VPN session from site three

29
01:10.920 --> 01:12.400
that we're gonna use over to site four.

30
01:12.400 --> 01:15.240
And as part of that, we're gonna need to set up an identity.

31
01:15.240 --> 01:17.160
So the identity we're gonna use here at site three

32
01:17.160 --> 01:19.760
is gonna be its globally reachable IP address.

33
01:19.760 --> 01:23.200
And that's gonna be 23.1.2.30.

34
01:23.200 --> 01:24.720
And as far as the tunnels go,

35
01:24.720 --> 01:26.840
the I tunnel and the IPsec tunnel,

36
01:26.840 --> 01:29.400
let's go ahead and use the default profiles for those.

37
01:29.400 --> 01:31.200
So when we connected to the Cisco device,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:29.400 --> 01:31.200
So when we connected to the Cisco device,

38
01:31.200 --> 01:33.640
we had to customize and tweak a few of those profiles.

39
01:33.640 --> 01:35.640
But here, because we're going from one NSX environment

40
01:35.640 --> 01:38.360
to another, if you use the same default profiles

41
01:38.360 --> 01:41.560
on both sides, all the policies and parameters should match.

42
01:41.560 --> 01:43.360
And then once we've configured site three,

43
01:43.360 --> 01:44.680
we'll then go ahead and configure

44
01:44.680 --> 01:47.280
a similar configuration over on site four.

45
01:47.280 --> 01:49.280
And because on site four, we have not yet created

46
01:49.280 --> 01:52.120
any VPN tunnels or IPsec services yet.

47
01:52.120 --> 01:54.480
We'll need to start up a VPN service

48
01:54.480 --> 01:56.480
and associate that with the tier zero gateway

49
01:56.480 --> 01:58.000
over here at site four.

50
01:58.000 --> 02:00.440
We'll then also need to set up a VPN session
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
01:58.000 --> 02:00.440
We'll then also need to set up a VPN session

51
02:00.440 --> 02:01.880
from the perspective of site four

52
02:01.880 --> 02:03.560
that's gonna connect over to site three.

53
02:03.560 --> 02:05.280
And so for its ID, we're gonna use

54
02:05.280 --> 02:08.200
its publicly readable IP address for all of its local IDs,

55
02:08.200 --> 02:10.320
24.1.2.40.

56
02:10.320 --> 02:12.920
And we'll also use the default profiles once again,

57
02:12.920 --> 02:15.760
because if we use the default profiles at both locations,

58
02:15.760 --> 02:18.200
all the parameters for the initial I tunnel

59
02:18.200 --> 02:20.600
and the IPsec tunnel, they'll all match up.

60
02:20.600 --> 02:22.800
So I'll make a little note there that'll be for IKE

61
02:22.800 --> 02:23.840
and IPsec.

62
02:23.840 --> 02:25.560
And then once we have the VPN sessions

63
02:25.560 --> 02:27.640
set up on both sides, we also need to make sure

64
02:27.640 --> 02:28.880
we set up routing.

65
02:28.880 --> 02:32.200
So we had a separate set of skills on OSPF routing
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:28.880 --> 02:32.200
So we had a separate set of skills on OSPF routing

66
02:32.200 --> 02:33.960
and also on BGP routing.

67
02:33.960 --> 02:36.680
And instead of setting up dynamic routing for this topology

68
02:36.680 --> 02:39.720
because we wanna focus on the route based VPNs themselves,

69
02:39.720 --> 02:41.920
let's just go ahead and do static routes.

70
02:41.920 --> 02:44.520
Which also reminds me we need to have a plan together

71
02:44.520 --> 02:46.760
regarding the network, the logical network

72
02:46.760 --> 02:49.640
that we're gonna place between site three and site four

73
02:49.640 --> 02:52.760
as part of our IPsec configuration with route based VPNs.

74
02:52.760 --> 02:55.880
So let me go ahead and draw in this logical network

75
02:55.880 --> 02:56.880
right here.

76
02:56.880 --> 02:59.160
And for this logical network, let's use the addressing space

77
02:59.160 --> 03:03.200
of 10.34.34.0.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
02:59.160 --> 03:03.200
of 10.34.34.0.

78
03:03.200 --> 03:08.080
And over here, let's use 33 for that endpoint and 44 over here.

79
03:08.080 --> 03:10.960
So when we set up our static routes at this T0 gateway

80
03:10.960 --> 03:12.840
here at site three, we'll say, hey,

81
03:12.840 --> 03:16.120
there is T0 gateway to get to the 1044 network.

82
03:16.120 --> 03:19.640
In fact, we could use a summary route and say 1044 anything.

83
03:19.640 --> 03:21.320
So we could say here at site three,

84
03:21.320 --> 03:23.760
hey, to get to the 1044 anything,

85
03:23.760 --> 03:27.600
the next top is gonna be 103434.44.

86
03:27.600 --> 03:29.080
And that would cause the T0 gateway

87
03:29.080 --> 03:30.880
to route that specific traffic from here,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
03:29.080 --> 03:30.880
to route that specific traffic from here,

88
03:30.880 --> 03:33.720
for example, going over here over that logical network.

89
03:33.720 --> 03:35.920
And that's where IPsec is gonna be implemented

90
03:35.920 --> 03:37.640
on any traffic going over that network.

91
03:37.640 --> 03:39.880
And then similar logic over here at site four,

92
03:39.880 --> 03:41.960
we'd tell the T0 gateway over here

93
03:41.960 --> 03:45.560
to get to the 1033 anything, the next top from your perspective,

94
03:45.560 --> 03:47.440
Mr. T0 at site four,

95
03:47.440 --> 03:51.120
is gonna be the next top of 103434.33.

96
03:51.120 --> 03:52.680
Which once again would route that traffic

97
03:52.680 --> 03:53.880
over this logical network.

98
03:53.880 --> 03:56.600
And as a result, would also be protected by IPsec

99
03:56.600 --> 03:57.600
as it goes across.

100
03:57.600 --> 04:00.440
So what the internet would see on this public network right here,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
03:57.600 --> 04:00.440
So what the internet would see on this public network right here,

101
04:00.440 --> 04:02.320
they would just see traffic going back and forth

102
04:02.320 --> 04:05.520
between 23, 1, 230 and 24, 1, 240,

103
04:05.520 --> 04:07.280
with all that traffic encrypted.

104
04:07.280 --> 04:10.160
Now initially, when they negotiate the Ike tunnel initially,

105
04:10.160 --> 04:13.120
they're gonna be using UDP port 500.

106
04:13.120 --> 04:15.040
And if we're going through NAT, which we're not in this case,

107
04:15.040 --> 04:18.080
but if we're going through NAT, it'd be UDP 4500.

108
04:18.080 --> 04:20.520
That'd be for the negotiation setup of the Ike tunnel.

109
04:20.520 --> 04:25.520
And then the actual ESP traffic is protocol number 50

110
04:25.520 --> 04:27.520
for the encapsulating security payload.

111
04:27.520 --> 04:30.680
Effectively encrypted protected IPsec traffic
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

111
04:27.520 --> 04:30.680
Effectively encrypted protected IPsec traffic

112
04:30.680 --> 04:33.160
that's going back and forth between the two sites.

113
04:33.160 --> 04:35.520
And then of course, the last step after we've set all this up

114
04:35.520 --> 04:39.680
is to go ahead and test and verify it, which we'll do as well.

115
04:39.680 --> 04:41.200
So with this game plan in mind,

116
04:41.200 --> 04:42.760
I'm super excited about the next step

117
04:42.760 --> 04:44.960
and that is to validate our existing topology

118
04:44.960 --> 04:47.240
to make sure that it is accurate and functioning.

119
04:47.240 --> 04:50.000
So in the next video, let's begin with exactly that

120
04:50.000 --> 04:52.200
and we'll verify our existing topology.

121
04:52.200 --> 04:54.700
So I'll see you in the next video in just a moment.