WEBVTT

1
00:00.000 --> 00:02.160
So for our first stop in our game plan,

2
00:02.160 --> 00:05.340
it is to make sure that our existing topology has

3
00:05.340 --> 00:08.480
reachability at these respective IP addresses and that

4
00:08.480 --> 00:11.360
the VMs at those respective sites can get out to the Internet

5
00:11.360 --> 00:13.880
just to confirm that Nat and everything else is currently working.

6
00:13.880 --> 00:16.880
So with that in mind, let's start here at site 3.

7
00:16.880 --> 00:21.440
So here is the NSX manager for site 3 and let's go to system.

8
00:21.440 --> 00:23.520
And with system selected on the left-hand side,

9
00:23.520 --> 00:27.040
let's expand fabric and let's just take a look at our node real quick to make

10
00:27.040 --> 00:27.240
sure

11
00:27.240 --> 00:30.320
they're edge nodes and they are up, they look good to go.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:27.240 --> 00:30.320
they're edge nodes and they are up, they look good to go.

12
00:30.320 --> 00:34.520
And let's also peek in on our hosts as part of site 3.

13
00:34.520 --> 00:38.160
So we'll expand this cluster and looks like our hosts are up as well.

14
00:38.160 --> 00:39.120
All right, fantastic.

15
00:39.120 --> 00:43.960
Let's also verify our IP addressing this news on our tier 0 gateway here at

16
00:43.960 --> 00:44.520
site 3.

17
00:44.520 --> 00:48.370
So we'll click on networking and then under connectivity, we'll click on tier 0

18
00:48.370 --> 00:49.280
gateway.

19
00:49.280 --> 00:53.760
And let's go ahead and expand the tier 0 gateway, go down to interfaces.

20
00:53.760 --> 00:55.160
And currently has four.

21
00:55.160 --> 00:55.920
Why does it have four?

22
00:55.920 --> 00:56.920
Oh, I know.

23
00:56.920 --> 01:01.120
Has two that we set up for the IPsec policy base VPN that we're doing to an
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:56.920 --> 01:01.120
Has two that we set up for the IPsec policy base VPN that we're doing to an

24
01:01.120 --> 01:01.920
external device.

25
01:01.920 --> 01:04.880
And then I've got two here on VLAN 23.

26
01:04.880 --> 01:10.320
So their IP addresses are 231231 and 231232.

27
01:10.320 --> 01:13.520
And then we also have a virtual IP address for this gateway.

28
01:13.520 --> 01:17.120
So right here, where it says HAVIP, we'll click on that hyperlink where it says

29
01:17.120 --> 01:17.520
two.

30
01:17.520 --> 01:22.040
And sure enough, we have the global address 231230 right there, which is being

31
01:22.040 --> 01:22.360
supported

32
01:22.360 --> 01:25.480
on the back end by edge one and edge two.

33
01:25.480 --> 01:27.400
Let's also take a peek at our segments.

34
01:27.400 --> 01:29.320
So here at site three, we'll get on segments.

35
01:29.320 --> 01:34.400
We have a site three subnet 33, which is using the 1033 address base.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:29.320 --> 01:34.400
We have a site three subnet 33, which is using the 1033 address base.

36
01:34.400 --> 01:35.600
So that looks good.

37
01:35.600 --> 01:39.510
And let's go verify that a client of VM on that network segment can get out to

38
01:39.510 --> 01:40.400
the internet.

39
01:40.400 --> 01:43.680
So here is the vSphere client for site three.

40
01:43.680 --> 01:46.840
And here is a VM called red one and red two.

41
01:46.840 --> 01:48.880
And let me take one of those and rename it.

42
01:48.880 --> 01:51.680
So I'll right click and go to rename right there.

43
01:51.680 --> 01:56.480
Let me call that site three red VM and click on OK.

44
01:56.480 --> 01:59.480
And let's go ahead and power that VM on as well.

45
01:59.480 --> 02:03.140
And let's bring up a web console that'll be a little bit bigger and easier to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
01:59.480 --> 02:03.140
And let's bring up a web console that'll be a little bit bigger and easier to

46
02:03.140 --> 02:03.400
see.

47
02:03.400 --> 02:06.680
So in the top left hand corner, we're at the site three red VM.

48
02:06.680 --> 02:09.880
Let's type in if config or ethernet zero.

49
02:09.880 --> 02:13.540
Just to confirm it has an IP address, let's type in route dash and confirm it

50
02:13.540 --> 02:14.240
has a default

51
02:14.240 --> 02:16.240
route and let's do a ping.

52
02:16.240 --> 02:21.670
Let's do account of five out to www.vmware.com and press enter and that's

53
02:21.670 --> 02:22.960
looking good.

54
02:22.960 --> 02:23.960
All right.

55
02:23.960 --> 02:26.200
So it looks like site three is good to go.

56
02:26.200 --> 02:27.800
We could also do a trace route.

57
02:27.800 --> 02:31.700
I'll say no name resolution and let's say a maximum number of hops of five and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:27.800 --> 02:31.700
I'll say no name resolution and let's say a maximum number of hops of five and

58
02:31.700 --> 02:32.040
let's

59
02:32.040 --> 02:35.840
go out to Google at eight dot eight to eight press enter.

60
02:35.840 --> 02:39.040
And here I just want to verify that indeed we are going out through the correct

61
02:39.040 --> 02:39.400
service

62
02:39.400 --> 02:43.200
provider and that's at 23 dot one dot one.

63
02:43.200 --> 02:47.100
And that's the service provider who's supporting site three also back here at

64
02:47.100 --> 02:47.920
the NSX manager

65
02:47.920 --> 02:48.920
for site three.

66
02:48.920 --> 02:53.000
I just want to verify our current situation regarding IP sec because we did set

67
02:53.000 --> 02:53.320
up an

68
02:53.320 --> 02:55.320
IP sec tunnel to an external router.

69
02:55.320 --> 02:56.920
So let's go to networking on the left.

70
02:56.920 --> 03:00.130
We'll click on VPN and sure enough here we have let me collapse that way a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
02:56.920 --> 03:00.130
We'll click on VPN and sure enough here we have let me collapse that way a

71
03:00.130 --> 03:00.640
little bit

72
03:00.640 --> 03:01.640
more room.

73
03:01.640 --> 03:05.560
Here we have our VPN service that we use for that site to site VPN tunnel.

74
03:05.560 --> 03:08.600
So that's the parent service that's enabled on the T zero gateway.

75
03:08.600 --> 03:13.120
If click here on IP sections, here's our session to our external Cisco router.

76
03:13.120 --> 03:15.200
And that looks like it is currently working.

77
03:15.200 --> 03:18.800
So if we were to bring in our client real quick and if we were to do a ping for

78
03:18.800 --> 03:19.320
example

79
03:19.320 --> 03:23.070
out to 10 dot eight dot zero dot 10, which is going through that tunnel over to

80
03:23.070 --> 03:23.720
the external

81
03:23.720 --> 03:27.320
router over the IP sec tunnel and press enter that traffic should be going over

82
03:27.320 --> 03:28.000
the IP sec

83
03:28.000 --> 03:29.000
tunnel.

84
03:29.000 --> 03:32.790
We can verify that right here with you statistics for the IP [garbled] session going
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
03:29.000 --> 03:32.790
We can verify that right here with you statistics for the IP [garbled] session going

85
03:32.790 --> 03:33.280
to the Cisco

86
03:33.280 --> 03:34.280
router.

87
03:34.280 --> 03:37.120
And sure enough there we have some packets in and out if we click on refresh

88
03:37.120 --> 03:37.520
because

89
03:37.520 --> 03:41.460
the ping is still happening that should be incrementing and it is that looks

90
03:41.460 --> 03:41.880
great.

91
03:41.880 --> 03:43.240
Let's we'll click on close there.

92
03:43.240 --> 03:46.420
And one other thing we can do while we have this up is let's go take a look at

93
03:46.420 --> 03:46.800
some of

94
03:46.800 --> 03:51.720
those details at the CLI for the active edge node.

95
03:51.720 --> 03:54.920
So to determine who's the active edge node, let's go ahead and back to our top

96
03:54.920 --> 03:55.400
ology here

97
03:55.400 --> 03:58.360
at site three by clicking on network topology.

98
03:58.360 --> 04:01.080
Let's double click right here on the T zero gateway.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
03:58.360 --> 04:01.080
Let's double click right here on the T zero gateway.

99
04:01.080 --> 04:04.040
That'll show us the fabric and if we zoom in, this is showing us that edge one

100
04:04.040 --> 04:04.440
is the

101
04:04.440 --> 04:06.920
active node and edge two is standby.

102
04:06.920 --> 04:09.520
So edge one if we click on here once.

103
04:09.520 --> 04:12.040
So this is the management address for edge one who's currently active.

104
04:12.040 --> 04:16.510
So let's take a moment and go over to that device with SSH and just take a peek

105
04:16.510 --> 04:16.880
from

106
04:16.880 --> 04:17.880
the command line.

107
04:17.880 --> 04:21.820
So here we're logged on to the edge one device over at site three and if we do

108
04:21.820 --> 04:22.440
a gate gate

109
04:22.440 --> 04:24.440
ways and press enter.

110
04:24.440 --> 04:27.910
Here's our services router for the tier zero gateway and we go into that VRF

111
04:27.910 --> 04:28.400
with VRF

112
04:28.400 --> 04:33.200
space one and do a get route press enter that'll show us the routing table.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
04:28.400 --> 04:33.200
space one and do a get route press enter that'll show us the routing table.

113
04:33.200 --> 04:37.050
So there's our default route going through our service provider A and here's

114
04:37.050 --> 04:37.800
the specific

115
04:37.800 --> 04:39.840
workaround for IP sec tunnel.

116
04:39.840 --> 04:45.590
And so from here we should be able to ping 24 dot 1 dot 2 dot 40, which is the

117
04:45.590 --> 04:46.040
reach

118
04:46.040 --> 04:48.760
well IP address over at site four.

119
04:48.760 --> 04:51.680
Let's verify that as well and that looks good too.

120
04:51.680 --> 04:52.680
Fantastic.

121
04:52.680 --> 04:56.640
We'll do a control C and let's exit out of the VRF one and from here, let's do

122
04:56.640 --> 04:57.040
a get

123
04:57.040 --> 05:01.410
IP sec VPN, let's do a question mark and let's go ahead and type in session and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
04:57.040 --> 05:01.410
IP sec VPN, let's do a question mark and let's go ahead and type in session and

124
05:01.410 --> 05:02.400
press enter.

125
05:02.400 --> 05:05.710
So here's our current IP sec session that we set up in our previous skill and

126
05:05.710 --> 05:06.080
this is

127
05:06.080 --> 05:10.040
going between the site three tier zero gateway and our external router.

128
05:10.040 --> 05:13.490
So as part of that configuration, because it's policy based here are the policy

129
05:13.490 --> 05:13.840
rules

130
05:13.840 --> 05:18.720
effectively saying traffic from 1033 zero going to 1080.

131
05:18.720 --> 05:20.240
Go ahead and encrypt it.

132
05:20.240 --> 05:25.590
It also implies that traffic coming from 1080 coming into 1033 zero should be

133
05:25.590 --> 05:26.320
decrypted

134
05:26.320 --> 05:30.600
and there's the local on remote IP and peer IDs in use for that connection.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

134
05:26.320 --> 05:30.600
and there's the local on remote IP and peer IDs in use for that connection.

135
05:30.600 --> 05:34.060
And one of the benefits of looking at this output here at the CLI is that as we

136
05:34.060 --> 05:34.440
start

137
05:34.440 --> 05:39.470
to add additional IP [garbled] sessions, including a route based IP [garbled] session, we

138
05:39.470 --> 05:40.240
can compare

139
05:40.240 --> 05:44.690
and contrast the differences between the route based IP [garbled] session and the

140
05:44.690 --> 05:45.560
policy based

141
05:45.560 --> 05:46.720
IP [garbled] session.

142
05:46.720 --> 05:49.940
So now that we've taken a peek at site three and verified it, let's also do a

143
05:49.940 --> 05:50.520
quick check

144
05:50.520 --> 05:52.160
over at site four.

145
05:52.160 --> 05:53.160
So here is site four.

146
05:53.160 --> 05:56.940
I'm going to be using dark mode on site four for both the vSphere client and

147
05:56.940 --> 05:57.600
also for

148
05:57.600 --> 06:00.920
the NSX manager to help us differentiate the two.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

148
05:57.600 --> 06:00.920
the NSX manager to help us differentiate the two.

149
06:00.920 --> 06:04.470
So back here at the vSphere client, let me go ahead and grab a VM that's

150
06:04.470 --> 06:05.400
currently on

151
06:05.400 --> 06:07.520
our subnet 44.

152
06:07.520 --> 06:10.780
And we go ahead and grab this guy right here and I'm going to rename it to make

153
06:10.780 --> 06:11.320
it easier

154
06:11.320 --> 06:12.320
to identify.

155
06:12.320 --> 06:16.040
So we'll right click from the drop down menu, click on rename and let's rename

156
06:16.040 --> 06:16.600
this site

157
06:16.600 --> 06:19.840
for violet VM.

158
06:19.840 --> 06:23.510
So that's just going to be a little helpful reminder with red as site three and

159
06:23.510 --> 06:23.960
violet

160
06:23.960 --> 06:25.280
as site four.

161
06:25.280 --> 06:27.600
So we'll rename that VM appropriately.

162
06:27.600 --> 06:30.480
So also go ahead and power it on.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

162
06:27.600 --> 06:30.480
So also go ahead and power it on.

163
06:30.480 --> 06:35.030
And let's also go ahead and open up a console just to verify it has access out

164
06:35.030 --> 06:36.320
to the internet.

165
06:36.320 --> 06:39.290
So I'll do a web console from a little bit more real estate here so we can see

166
06:39.290 --> 06:39.640
it a little

167
06:39.640 --> 06:40.640
bit better.

168
06:40.640 --> 06:45.310
So from the top left, we're at site four violet VM as to I have config for

169
06:45.310 --> 06:45.680
ethernet

170
06:45.680 --> 06:50.200
zero to verify it's IP address will type in route dash and let's also do a

171
06:50.200 --> 06:51.000
trace with

172
06:51.000 --> 06:53.040
a dash in for no name resolution.

173
06:53.040 --> 06:56.400
And let's go through a maximum number of hops of let's say eight and we'll go

174
06:56.400 --> 06:56.920
to Google

175
06:56.920 --> 06:59.120
dot com's love air fight DNS for us.

176
06:59.120 --> 07:01.800
It also verify real internet access for us.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

176
06:59.120 --> 07:01.800
It also verify real internet access for us.

177
07:01.800 --> 07:03.000
And that looks great.

178
07:03.000 --> 07:04.800
So there's the default gateway address.

179
07:04.800 --> 07:08.420
Here's our service provider over at site B and although this address looks like

180
07:08.420 --> 07:08.720
it's

181
07:08.720 --> 07:11.360
a global dress, it's just one I'm using my lab environment.

182
07:11.360 --> 07:15.480
So I'm actually looping back through my 192 168 with some additional net

183
07:15.480 --> 07:16.280
happening and

184
07:16.280 --> 07:19.750
it's going up to my real service provider and the next few hops into my service

185
07:19.750 --> 07:20.400
provider,

186
07:20.400 --> 07:24.760
which is Cox communications here in Las Vegas and it's going out to points

187
07:24.760 --> 07:25.840
beyond that as

188
07:25.840 --> 07:29.440
it goes up to the final destination once to two, et cetera, right here.

189
07:29.440 --> 07:32.700
So it's one of verify that we're going out to the correct service provider here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

189
07:29.440 --> 07:32.700
So it's one of verify that we're going out to the correct service provider here

190
07:32.700 --> 07:33.000
on this

191
07:33.000 --> 07:37.800
VM over at site four and that we have internet access and all that looks great.

192
07:37.800 --> 07:42.080
So here at site four, who want to confirm who the active edge node is.

193
07:42.080 --> 07:45.520
We could go ahead and click on networking, then go down to our topology and

194
07:45.520 --> 07:45.960
then here's

195
07:45.960 --> 07:46.960
our tears are okay.

196
07:46.960 --> 07:49.750
We could go ahead and just double click on that and that's going to confirm for

197
07:49.750 --> 07:50.040
us who

198
07:50.040 --> 07:51.040
the active is.

199
07:51.040 --> 07:55.800
So here at site four, the active node is edge to self who want to confirm.

200
07:55.800 --> 07:56.800
It's details.

201
07:56.800 --> 08:00.140
We could go ahead and click on it here that we give us the IP address it's at
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

201
07:56.800 --> 08:00.140
We could go ahead and click on it here that we give us the IP address it's at

202
08:00.140 --> 08:00.640
and then

203
08:00.640 --> 08:02.640
we could SSH there as well.

204
08:02.640 --> 08:05.920
If we wanted to check out details regarding edge two.

205
08:05.920 --> 08:09.860
So at the moment edge two, if we go down here to VPN, we don't have any VPN

206
08:09.860 --> 08:10.480
services

207
08:10.480 --> 08:13.600
enabled at all anywhere here at site four.

208
08:13.600 --> 08:17.230
And as a result, we also are not going to have any IP [garbled] session set up, but

209
08:17.230 --> 08:17.560
we'll

210
08:17.560 --> 08:20.360
change that as we implement our IP [garbled] services.

211
08:20.360 --> 08:24.190
So as far as our game plan is concerned, we have validated our existing to

212
08:24.190 --> 08:24.960
apology.

213
08:24.960 --> 08:28.800
We also verified that we have basic connectivity between those two IP addresses

214
08:28.800 --> 08:29.360
because of

215
08:29.360 --> 08:33.680
our site three at the CLI on the edge node, we were able to ping 24 dot 1 dot 2
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

215
08:29.360 --> 08:33.680
our site three at the CLI on the edge node, we were able to ping 24 dot 1 dot 2

216
08:33.680 --> 08:34.360
dot 40

217
08:34.360 --> 08:36.280
just to confirm connectivity there.

218
08:36.280 --> 08:39.860
And we also verified from each of the VMs respectively, that they could get out

219
08:39.860 --> 08:40.160
to the

220
08:40.160 --> 08:41.160
internet.

221
08:41.160 --> 08:44.980
So our next stop in our journey then is to go to site three and begin the

222
08:44.980 --> 08:46.080
implementation

223
08:46.080 --> 08:51.560
of our IP [garbled] site route based VPN tunnel between site three and site four.

224
08:51.560 --> 08:54.880
So I'll see you in the next video as we begin our configuration for IP [garbled] site

225
08:54.880 --> 08:55.280
site VPN

226
08:55.280 --> 08:56.840
tunnels here on site three.

227
08:56.840 --> 09:05.680
[BLANK_AUDIO]