WEBVTT

1
00:00.000 --> 00:05.000
So now it's time to begin the IPsec configuration here on site 4.

2
00:05.000 --> 00:07.800
So let's head over to site 4 and let's begin.

3
00:07.800 --> 00:10.280
So one of the most important things we need to do right here

4
00:10.280 --> 00:11.720
is to make sure we're on the right site.

5
00:11.720 --> 00:14.960
So I'm going to go ahead and head over to site 4.

6
00:14.960 --> 00:18.160
So this is the NSX manager for site 4.

7
00:18.160 --> 00:19.960
I have it in dark mode here to help remind me

8
00:19.960 --> 00:22.320
that this is site 4 and not site 3.

9
00:22.320 --> 00:25.640
And so here in site 4 under networking and VPN,

10
00:25.640 --> 00:28.040
we have absolutely no VPN services enabled

11
00:28.040 --> 00:29.640
for our tier 0 gateway.

12
00:29.640 --> 00:31.840
And we have no IPsec sessions, et cetera.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:29.640 --> 00:31.840
And we have no IPsec sessions, et cetera.

13
00:31.840 --> 00:34.120
So let's begin by creating a VPN service

14
00:34.120 --> 00:36.400
and enabling it on our tier 0 gateway.

15
00:36.400 --> 00:38.880
So if we at the moment went to network topology

16
00:38.880 --> 00:41.600
and then we went to our tier 0 gateway right here

17
00:41.600 --> 00:43.080
and hovered over services,

18
00:43.080 --> 00:45.600
it's going to indicate that we have gateway firewall rules

19
00:45.600 --> 00:49.320
and DHCP and that, but we don't have any VPN services yet.

20
00:49.320 --> 00:52.000
So we're going to fix that by going back to VPN.

21
00:52.000 --> 00:54.520
And then in the main window here with VPN services selected,

22
00:54.520 --> 00:56.240
we'll click on add service.

23
00:56.240 --> 00:58.720
And from the dropdown, we'll click right here on IPsec

24
00:58.720 --> 01:00.240
to add an IPsec service.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:58.720 --> 01:00.240
to add an IPsec service.

25
01:00.240 --> 01:02.960
And let's call this site 4 IPsec.

26
01:02.960 --> 01:05.040
And the service type is IPsec.

27
01:05.040 --> 01:07.480
And we want to associate this IPsec service

28
01:07.480 --> 01:09.320
with our T0 gateway.

29
01:09.320 --> 01:10.400
And that's this one right here.

30
01:10.400 --> 01:12.120
So I'll choose that from the dropdown

31
01:12.120 --> 01:15.040
and we'll take all the other defaults and click on save.

32
01:15.040 --> 01:16.400
And I'll click on no.

33
01:16.400 --> 01:17.640
So now that it exists,

34
01:17.640 --> 01:19.720
if we went back to our network topology

35
01:19.720 --> 01:21.880
and if we went back to our tier 0 gateway here

36
01:21.880 --> 01:23.120
and hovered over services,

37
01:23.120 --> 01:27.200
now we have the VPN service available as well.

38
01:27.200 --> 01:29.440
And then what we can do is leverage that VPN service

39
01:29.440 --> 01:33.720
and create a specific IPsec route based VPN session
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:29.440 --> 01:33.720
and create a specific IPsec route based VPN session

40
01:33.720 --> 01:36.320
from site 4 over to site 3.

41
01:36.320 --> 01:39.160
So to do that once again, we'll go back to VPN.

42
01:39.160 --> 01:40.400
And then with VPN selected,

43
01:40.400 --> 01:42.080
I'm going to go ahead and collapse the left hand side

44
01:42.080 --> 01:44.120
to give us a little bit more room here to work.

45
01:44.120 --> 01:46.880
And then we'll click on the sub tab here for IPsec sessions.

46
01:46.880 --> 01:48.320
And then we'll click on add,

47
01:48.320 --> 01:50.600
we'll add a route based VPN session

48
01:50.600 --> 01:53.320
and put in the details for site 4.

49
01:53.320 --> 01:55.680
So we'll click on add IPsec session.

50
01:55.680 --> 01:56.840
We want to do route based,

51
01:56.840 --> 01:58.920
which is going to build the logical network,

52
01:58.920 --> 02:01.280
the 1034, 34 network that we're using
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:58.920 --> 02:01.280
the 1034, 34 network that we're using

53
02:01.280 --> 02:03.080
between site 4 and site 3.

54
02:03.080 --> 02:05.320
So we'll click here on route based from the drop down

55
02:05.320 --> 02:06.840
and we'll call this one to site 3.

56
02:06.840 --> 02:08.480
So we're on site 4.

57
02:08.480 --> 02:10.840
So this session called to site 3,

58
02:10.840 --> 02:14.560
we very easy to remember what this specific IPsec session

59
02:14.560 --> 02:16.760
is going to, it's going over to site 3.

60
02:16.760 --> 02:18.760
It's going to be route based based on the choice

61
02:18.760 --> 02:20.000
we made from the drop down.

62
02:20.000 --> 02:21.720
And then for the VPN service,

63
02:21.720 --> 02:23.120
we're going to choose the VPN service

64
02:23.120 --> 02:25.200
that we just enabled a moment ago.

65
02:25.200 --> 02:27.960
And then for the local endpoint from the drop down,

66
02:27.960 --> 02:29.880
we don't have any local endpoints yet created,

67
02:29.880 --> 02:31.120
but we can do that right now.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:29.880 --> 02:31.120
but we can do that right now.

68
02:31.120 --> 02:34.400
So the local endpoint here on site 4

69
02:34.400 --> 02:37.360
is going to be 24.1.2.40.

70
02:37.360 --> 02:40.280
It's the reachable IP address that we're using

71
02:40.280 --> 02:41.480
in this lab topology.

72
02:41.480 --> 02:43.240
So we'll click on the three dots.

73
02:43.240 --> 02:46.680
We'll create a brand new local endpoint for site 4

74
02:46.680 --> 02:47.760
and we'll put in the name,

75
02:47.760 --> 02:50.760
I'm going to call it 24.1.2.40.

76
02:50.760 --> 02:52.480
And for the actual IP address,

77
02:52.480 --> 02:54.920
it's going to be 24.1.2.40.

78
02:54.920 --> 02:56.760
And then for the local ID,

79
02:56.760 --> 02:58.000
again, we don't have to put it there

80
02:58.000 --> 03:00.600
because it was just used the actual IP address by default,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
02:58.000 --> 03:00.600
because it was just used the actual IP address by default,

81
03:00.600 --> 03:02.440
but I'm going to hard code it just for grins

82
03:02.440 --> 03:04.800
at 24.1.2.40.

83
03:04.800 --> 03:05.640
And that looks great.

84
03:05.640 --> 03:07.400
So we'll go ahead and click on save.

85
03:07.400 --> 03:10.360
So now we have the name of this IP succession.

86
03:10.360 --> 03:11.440
It's route based.

87
03:11.440 --> 03:13.400
We're using this parent IPsec service

88
03:13.400 --> 03:16.800
and the local endpoint is 24.1.2.40.

89
03:16.800 --> 03:19.840
That's both the name and also the IP address

90
03:19.840 --> 03:21.440
inside of that endpoint.

91
03:21.440 --> 03:22.640
And then for the remote IP,

92
03:22.640 --> 03:26.880
that's the peers address, which is 23.1.2.30.

93
03:26.880 --> 03:29.480
And that's the reachable address over at site 3.

94
03:29.480 --> 03:31.240
So as we continue our configuration,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
03:29.480 --> 03:31.240
So as we continue our configuration,

95
03:31.240 --> 03:33.240
let's go down to the authentication mode.

96
03:33.240 --> 03:35.800
If we're using pre-shared keys over at site 3,

97
03:35.800 --> 03:38.560
we want to use pre-shared keys over here at site 4 as well

98
03:38.560 --> 03:41.320
for the session going back and forth between them.

99
03:41.320 --> 03:43.240
And then I'll go ahead and put in the pre-shared key

100
03:43.240 --> 03:45.360
that I put in over at site 3.

101
03:45.360 --> 03:47.160
So I've just supplied that pre-shared key

102
03:47.160 --> 03:49.240
and just to confirm it's the same key

103
03:49.240 --> 03:50.640
I used over at site 3.

104
03:50.640 --> 03:51.600
Fantastic.

105
03:51.600 --> 03:53.400
And over here on the right, it wants the tunnel interface

106
03:53.400 --> 03:54.040
address.

107
03:54.040 --> 03:55.400
And again, the tunnel here is referring

108
03:55.400 --> 03:59.920
to the logical subnet that we're using between site 4

109
03:59.920 --> 04:00.960
and site 3.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
03:59.920 --> 04:00.960
and site 3.

110
04:00.960 --> 04:04.160
So here at site 4, we want to use 103434

111
04:04.160 --> 04:07.320
with the last octet of 44 based on our plan.

112
04:07.320 --> 04:09.120
And that is a slash 24.

113
04:09.120 --> 04:11.400
Now, there's only two people on this network.

114
04:11.400 --> 04:13.320
It's going to be site 3 and site 4.

115
04:13.320 --> 04:15.080
So we don't really need to use a slash 24.

116
04:15.080 --> 04:19.000
But since it's all RFC 1918 private address space anyway,

117
04:19.000 --> 04:21.560
we can go ahead and not worry about wasting a few IP addresses.

118
04:21.560 --> 04:24.920
And then here for remote ID, we could also leave that blank.

119
04:24.920 --> 04:27.280
It'll just go ahead and use the remote IP address

120
04:27.280 --> 04:28.240
as a remote ID.

121
04:28.240 --> 04:30.160
But if we want to hard-code it here as well,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
04:28.240 --> 04:30.160
But if we want to hard-code it here as well,

122
04:30.160 --> 04:34.000
we go ahead and put that in as 23.1.2.30.

123
04:34.000 --> 04:35.400
And as we go through the configuration,

124
04:35.400 --> 04:38.400
any typos or mistakes that we've made

125
04:38.400 --> 04:41.920
will become apparent if the IP sector tunnel isn't working.

126
04:41.920 --> 04:44.440
So we'll cross that bridge when we come to it.

127
04:44.440 --> 04:46.400
So let's just take a look at the details here.

128
04:46.400 --> 04:47.960
I think I have everything correct.

129
04:47.960 --> 04:49.560
And we'll click on safe.

130
04:49.560 --> 04:52.000
All right, so now here comes the moment of truth.

131
04:52.000 --> 04:53.360
Currently says uninitialized.

132
04:53.360 --> 04:54.800
We'll click on refresh.

133
04:54.800 --> 04:57.680
We're hoping for some green indicators right here

134
04:57.680 --> 04:59.040
to indicate that that tunnel is working.

135
04:59.040 --> 04:59.720
And it is.

136
04:59.720 --> 05:00.760
All right.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
04:59.720 --> 05:00.760
All right.

137
05:00.760 --> 05:03.280
Do I sound surprised a little bit?

138
05:03.280 --> 05:06.840
Because just one typo with, for example, the IP addressing

139
05:06.840 --> 05:09.440
or the peer and so forth, that could cause it to fail.

140
05:09.440 --> 05:10.520
But that looks good.

141
05:10.520 --> 05:12.320
So if we click on view statistics here,

142
05:12.320 --> 05:13.520
that's going to show us statistics

143
05:13.520 --> 05:16.520
for the actual IPsec tunnel for the traffic going through it.

144
05:16.520 --> 05:18.600
And I would expect this to be all zeros.

145
05:18.600 --> 05:21.520
Because at the moment, we aren't sending any traffic

146
05:21.520 --> 05:22.680
through that tunnel.

147
05:22.680 --> 05:24.080
So if we were to bring up some clients,

148
05:24.080 --> 05:25.720
in fact, we've got a couple of clients up and running.

149
05:25.720 --> 05:28.600
I've got the little VM red here and the little VM violet

150
05:28.600 --> 05:29.400
over here.

151
05:29.400 --> 05:33.680
If we were to bring them up and try to ping each other,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

151
05:29.400 --> 05:33.680
If we were to bring them up and try to ping each other,

152
05:33.680 --> 05:35.240
that's not yet going to work.

153
05:35.240 --> 05:37.360
So let me go ahead and walk you through that.

154
05:37.360 --> 05:40.240
And then let's talk about why the IPsec tunnel,

155
05:40.240 --> 05:43.520
although it's in place, really isn't too valuable yet.

156
05:43.520 --> 05:47.360
So here is the little VM site three red,

157
05:47.360 --> 05:49.240
which is representing this icon right here

158
05:49.240 --> 05:50.560
for the little red VM.

159
05:50.560 --> 05:53.960
And let me bring in the little VM representing

160
05:53.960 --> 05:55.000
this VM right here.

161
05:55.000 --> 05:58.600
So here is the site for violet VM on the right.

162
05:58.600 --> 06:02.000
And here is the little site three red VM here on the left.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

162
05:58.600 --> 06:02.000
And here is the little site three red VM here on the left.

163
06:02.000 --> 06:04.280
So even though we verified that they can both reach

164
06:04.280 --> 06:06.440
the internet, we did that in a previous step.

165
06:06.440 --> 06:10.440
Now, if we try to ping, for example, over to 10.44.0.

166
06:10.440 --> 06:13.920
And then we confirm the IP addresses here real quick

167
06:13.920 --> 06:16.640
with an IF config for ethernet zero.

168
06:16.640 --> 06:18.720
And I'll do it on both sides.

169
06:18.720 --> 06:20.680
I have config for ethernet zero.

170
06:20.680 --> 06:22.760
So from the left hand side from the red VM,

171
06:22.760 --> 06:26.520
we'll do a ping over to the violet VM's IP address

172
06:26.520 --> 06:31.520
of 10.44.0.151 and press enter.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

172
06:26.520 --> 06:31.520
of 10.44.0.151 and press enter.

173
06:31.520 --> 06:33.800
The results there aren't too exciting

174
06:33.800 --> 06:35.080
because they're not working.

175
06:35.080 --> 06:37.760
And on the right hand side, on the violet VM,

176
06:37.760 --> 06:42.760
if we did a ping over to 10.33.0.152 and press enter,

177
06:42.760 --> 06:45.720
that also is going to be too exciting

178
06:45.720 --> 06:47.240
because it's not working.

179
06:47.240 --> 06:49.960
So let me move those two VMs off to the side for a moment

180
06:49.960 --> 06:53.160
and let's talk for a moment why that's not yet working.

181
06:53.160 --> 06:54.160
And here's the reason.

182
06:54.160 --> 06:57.880
Even though this logical network is up 10.34.34.0.

183
06:57.880 --> 07:00.200
And also we could verify this tunnel is up and active
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

183
06:57.880 --> 07:00.200
And also we could verify this tunnel is up and active

184
07:00.200 --> 07:02.840
by going to either of these edge devices,

185
07:02.840 --> 07:05.600
though the active device for the T zero gateway.

186
07:05.600 --> 07:08.040
And we should be able to ping across that

187
07:08.040 --> 07:09.640
to the other side's address.

188
07:09.640 --> 07:11.440
So at site three, let's go to the edge node

189
07:11.440 --> 07:13.720
that's active for the T zero gateway.

190
07:13.720 --> 07:17.320
And let's do a quick ping over to 10.34.34.44

191
07:17.320 --> 07:18.800
just to verify that it works.

192
07:18.800 --> 07:21.840
So here's the NSX manager for site three.

193
07:21.840 --> 07:23.480
Let's go to our topology.

194
07:23.480 --> 07:26.120
Let's go ahead and double click on the T zero gateway.

195
07:26.120 --> 07:28.080
And just to confirm which device is active,

196
07:28.080 --> 07:32.400
it is edge lab three dash one, which is the active edge node.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

196
07:28.080 --> 07:32.400
it is edge lab three dash one, which is the active edge node.

197
07:32.400 --> 07:34.000
And if we click on that edge node,

198
07:34.000 --> 07:35.320
it'll confirm for us the IP address,

199
07:35.320 --> 07:37.200
the management IP address of dot 36.

200
07:37.200 --> 07:39.400
So let's go talk to edge one here for a moment.

201
07:39.400 --> 07:41.040
So here is edge one.

202
07:41.040 --> 07:43.080
So now we're connected through an SSH session

203
07:43.080 --> 07:44.360
over to edge one.

204
07:44.360 --> 07:46.680
And let's type in get gateways, press enter.

205
07:46.680 --> 07:49.480
And let's go into VRF one, which is the VRF

206
07:49.480 --> 07:51.040
for our services router.

207
07:51.040 --> 07:52.640
So we'll type in VRF one.

208
07:52.640 --> 07:55.160
And from here, let's do a get route, press enter.

209
07:55.160 --> 07:57.520
And this confirms for us that we are directly connected.

210
07:57.520 --> 08:00.960
So that's T zero C for T zero directly connected network
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

210
07:57.520 --> 08:00.960
So that's T zero C for T zero directly connected network

211
08:00.960 --> 08:02.720
103434.34.

212
08:02.720 --> 08:07.560
So we should be able to ping from this VRF 1034.34.44,

213
08:07.560 --> 08:10.120
which is the other end over at site four.

214
08:10.120 --> 08:12.480
So we press enter, that works, no problem.

215
08:12.480 --> 08:14.640
However, the problem is if we do a get forwarding,

216
08:14.640 --> 08:16.080
this helps answer the question,

217
08:16.080 --> 08:18.200
what would this services router do

218
08:18.200 --> 08:20.520
if it ever got a packet that needed to be sent

219
08:20.520 --> 08:22.440
over to the 1044 address space?

220
08:22.440 --> 08:25.640
The answer is that 1044 is not explicitly

221
08:25.640 --> 08:26.720
in the routing tables.

222
08:26.720 --> 08:28.400
So the default route would be used.

223
08:28.400 --> 08:30.040
And then it'd be up to our service provider
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

223
08:28.400 --> 08:30.040
And then it'd be up to our service provider

224
08:30.040 --> 08:31.800
to go ahead and probably drop that traffic

225
08:31.800 --> 08:34.680
because it's trying to be sent to a private RFC 1918

226
08:34.680 --> 08:35.520
address space.

227
08:35.520 --> 08:38.120
So what we need to do is train both tier zero gateways

228
08:38.120 --> 08:41.040
that if they ever get traffic to the subnets

229
08:41.040 --> 08:43.160
at the other site, instead of sending it out

230
08:43.160 --> 08:44.920
to their service provider, what we need to do

231
08:44.920 --> 08:47.840
is train the routers to go ahead and use the next top address

232
08:47.840 --> 08:50.120
of dot 44 from the perspective of site three

233
08:50.120 --> 08:51.960
on this 103434 network.

234
08:51.960 --> 08:53.880
And from site four's perspective,

235
08:53.880 --> 08:56.400
for traffic that's trying to go over here to 1033,

236
08:56.400 --> 08:59.440
we need to route it this way using this next top address.

237
08:59.440 --> 09:02.360
So the moment traffic between here and here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

237
08:59.440 --> 09:02.360
So the moment traffic between here and here

238
09:02.360 --> 09:04.960
is not going over that logical network.

239
09:04.960 --> 09:06.400
Instead, from a routing perspective,

240
09:06.400 --> 09:08.200
it's trying to go out to our service providers.

241
09:08.200 --> 09:11.760
So if we want to have the traffic between 1033, et cetera,

242
09:11.760 --> 09:14.240
and 1044, et cetera, protected back and forth,

243
09:14.240 --> 09:16.200
we need to also make sure we set up the routing.

244
09:16.200 --> 09:19.080
And that, my friend, is exactly what we get to do

245
09:19.080 --> 09:20.000
in the next video.

246
09:20.000 --> 09:21.920
So I'll see you there in just a moment.