WEBVTT

1
00:00.000 --> 00:03.560
In this video, we're going to set up the routing so that these two tiers are

2
00:03.560 --> 00:04.320
all gateways.

3
00:04.320 --> 00:07.320
If they're trying to forward traffic from the perspective of site three down

4
00:07.320 --> 00:07.600
here to

5
00:07.600 --> 00:11.870
the 1044 address space or from site force perspective over here to the 1033

6
00:11.870 --> 00:12.320
address

7
00:12.320 --> 00:16.210
space that instead of saying that traffic naked just out to their service

8
00:16.210 --> 00:17.000
provider using

9
00:17.000 --> 00:20.110
the default route that instead of doing that, they should go ahead from a

10
00:20.110 --> 00:21.120
routing perspective

11
00:21.120 --> 00:25.680
and use the next top address of their good buddy on the other side of that

12
00:25.680 --> 00:26.760
logical network

13
00:26.760 --> 00:27.960
that we just set up.

14
00:27.960 --> 00:32.860
So from T zero's perspective over say three, the next top address to reach 1044
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:27.960 --> 00:32.860
So from T zero's perspective over say three, the next top address to reach 1044

15
00:32.860 --> 00:33.000
would

16
00:33.000 --> 00:38.840
be 10343444 and from the T zero's perspective in site four, if it wanted to

17
00:38.840 --> 00:40.200
reach the 1033

18
00:40.200 --> 00:46.160
address space, we need to train it that is next top should be 103434.33.

19
00:46.160 --> 00:49.640
So at the end of the day, the traffic still will be going through our service

20
00:49.640 --> 00:50.080
provider

21
00:50.080 --> 00:54.960
and just look like traffic going back and forth between 23123 and 241240.

22
00:54.960 --> 00:59.190
The two ends of the IPsec tunnel and the payload for all the user traffic going

23
00:59.190 --> 01:00.000
back and forth
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
01:00.000 --> 01:04.440
over that tunnel will all be encrypted and it'll just be inside of an ESP

25
01:04.440 --> 01:05.200
payload.

26
01:05.200 --> 01:08.200
And there's more than one way of implementing the routing to make this happen.

27
01:08.200 --> 01:12.260
One option is to use border gateway protocol, for example, with dynamic routing

28
01:12.260 --> 01:12.360
.

29
01:12.360 --> 01:15.780
But for the purpose of this set of videos, we're going to use static routing so

30
01:15.780 --> 01:16.320
we can

31
01:16.320 --> 01:21.380
focus most of our attention on the IPsec and not a whole giant discussion once

32
01:21.380 --> 01:21.840
again

33
01:21.840 --> 01:26.840
on setting up BGP. But if you do want to see a big discussion on BGP, check out

34
01:26.840 --> 01:27.320
our previous

35
01:27.320 --> 01:29.200
skill on that exact topic.

36
01:29.200 --> 01:33.080
So for now, let's implement the static routes here on the T zero at site three
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:29.200 --> 01:33.080
So for now, let's implement the static routes here on the T zero at site three

37
01:33.080 --> 01:33.680
and the T

38
01:33.680 --> 01:35.280
zero here at site four.

39
01:35.280 --> 01:37.320
So let's begin at site three.

40
01:37.320 --> 01:40.940
So we'll go to networking and we want to modify the routing on our T zero

41
01:40.940 --> 01:41.680
gateway.

42
01:41.680 --> 01:45.520
So on the left hand side, we'll click on T zero gateways.

43
01:45.520 --> 01:47.920
There's our red site three T zero gateway.

44
01:47.920 --> 01:51.740
We'll click on the three dots and then from the menu, we'll click on edit right

45
01:51.740 --> 01:52.240
there.

46
01:52.240 --> 01:55.840
Then we'll scroll down, we'll go to the routing section, expand that.

47
01:55.840 --> 01:57.960
And then currently it has two static routes.

48
01:57.960 --> 02:00.990
We'll click on that hyperlink for two because we are going to make an
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:57.960 --> 02:00.990
We'll click on that hyperlink for two because we are going to make an

49
02:00.990 --> 02:01.920
additional static

50
02:01.920 --> 02:05.420
route. So we currently have a default route going out through our service

51
02:05.420 --> 02:06.000
provider.

52
02:06.000 --> 02:09.930
We have a route that's involved with our site to site policy based VPN tunnel

53
02:09.930 --> 02:10.440
we set up

54
02:10.440 --> 02:12.920
in the previous skill and we want to add one more.

55
02:12.920 --> 02:15.080
So we'll click right here and add static route.

56
02:15.080 --> 02:17.760
So here at site three, we'll call this static route.

57
02:17.760 --> 02:20.560
We'll call it to site for subnets.

58
02:20.560 --> 02:25.120
And for the destination target network, let's use 10 dot 44 dot anything.

59
02:25.120 --> 02:29.930
And that way, if at site four, they want to make additional subnets under 1044,

60
02:29.930 --> 02:30.400
for example,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:29.930 --> 02:30.400
for example,

61
02:30.400 --> 02:35.240
1044 one or 1044 two, this static route will simply cover anything that starts

62
02:35.240 --> 02:36.680
with 1044

63
02:36.680 --> 02:39.960
as we only care about matching on the first two octets right there.

64
02:39.960 --> 02:42.780
And then for the next top, we'll click right here on set and then we'll click

65
02:42.780 --> 02:43.440
here on set

66
02:43.440 --> 02:47.080
next tops and we're going to take a look at our diagram once again.

67
02:47.080 --> 02:51.120
So what we want to do is we have specified for this route, the 1044 anything.

68
02:51.120 --> 02:53.120
We want to use the next top right here.

69
02:53.120 --> 02:57.730
So that's what we're going to put as the next top for this static route on the

70
02:57.730 --> 02:58.200
T zero

71
02:58.200 --> 02:59.960
gateway at site three.

72
02:59.960 --> 03:05.520
So for the next top, it's going to be 10 dot 34 dot 34 dot 44 just like that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
02:59.960 --> 03:05.520
So for the next top, it's going to be 10 dot 34 dot 34 dot 44 just like that.

73
03:05.520 --> 03:09.660
And then furthermore, I'm going to go ahead and lock that down just to be used

74
03:09.660 --> 03:10.200
with our

75
03:10.200 --> 03:11.400
IP succession.

76
03:11.400 --> 03:14.640
So here we have an option of selecting a whole bunch of different interfaces.

77
03:14.640 --> 03:18.990
And I'm going to choose our site for IP, second VPN session as the scope for

78
03:18.990 --> 03:19.840
this specific

79
03:19.840 --> 03:20.840
route.

80
03:20.840 --> 03:24.420
And then we'll click on add, then we'll click on apply, then we'll click on

81
03:24.420 --> 03:24.920
save, then

82
03:24.920 --> 03:29.120
we'll click on close, now scroll down and click on close editing.

83
03:29.120 --> 03:32.860
And so since we just implemented that additional static route, let's also just
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
03:29.120 --> 03:32.860
And so since we just implemented that additional static route, let's also just

84
03:32.860 --> 03:33.560
take a moment

85
03:33.560 --> 03:38.440
and verify that the active edge node currently has that new route.

86
03:38.440 --> 03:41.530
And because I currently have a console open to that from our previous

87
03:41.530 --> 03:42.800
discussion, let me

88
03:42.800 --> 03:46.960
just hit the up arrow key and do a get forwarding for the VRF for our services

89
03:46.960 --> 03:47.720
router.

90
03:47.720 --> 03:50.200
We'll press enter and scroll up.

91
03:50.200 --> 03:51.200
And here we go.

92
03:51.200 --> 03:52.280
So there's our new route.

93
03:52.280 --> 03:56.280
So previously, we didn't have a route for the 1044 anything.

94
03:56.280 --> 03:59.720
So now we do and the next top is 10343444.

95
03:59.720 --> 04:03.850
And now we need to do a similar treatment over at site four, still make a road
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
03:59.720 --> 04:03.850
And now we need to do a similar treatment over at site four, still make a road

96
04:03.850 --> 04:04.440
trip over

97
04:04.440 --> 04:05.440
to site four.

98
04:05.440 --> 04:06.440
It's in dark mode.

99
04:06.440 --> 04:08.680
We're going to go to the NSX manager for site four.

100
04:08.680 --> 04:12.270
So with networking selected on the left hand side, we'll go down to our tier

101
04:12.270 --> 04:13.080
zero gateways

102
04:13.080 --> 04:14.240
right there.

103
04:14.240 --> 04:17.810
And we're going to edit the details for our site for tier zero gateway by

104
04:17.810 --> 04:18.520
clicking on

105
04:18.520 --> 04:19.520
the three dots.

106
04:19.520 --> 04:20.920
I'll collapse this on the left.

107
04:20.920 --> 04:22.480
So we have a little more room to work with.

108
04:22.480 --> 04:25.800
Click on three dots, click on edit, and then we'll go down to our routing

109
04:25.800 --> 04:26.400
section.

110
04:26.400 --> 04:27.680
We'll expand that.

111
04:27.680 --> 04:30.080
And currently we have one static default route.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

111
04:27.680 --> 04:30.080
And currently we have one static default route.

112
04:30.080 --> 04:33.080
So we'll click on that link and we'll add a second route.

113
04:33.080 --> 04:35.120
So we'll go ahead and click on add static route.

114
04:35.120 --> 04:38.120
We'll name this two site three subnets.

115
04:38.120 --> 04:42.030
And let's go ahead and use a summary route of 10 dot 33 dot zero with a 16 bit

116
04:42.030 --> 04:42.520
mass that

117
04:42.520 --> 04:44.040
way in the future.

118
04:44.040 --> 04:48.620
If site three wants to have additional subnets under 1033 like 1033 one and two

119
04:48.620 --> 04:49.480
and so forth,

120
04:49.480 --> 04:51.480
this route will still cover all those.

121
04:51.480 --> 04:52.800
And then we'll go ahead and set the next top.

122
04:52.800 --> 04:56.360
So we'll click here on set in the next tops column right there.

123
04:56.360 --> 04:58.400
And we'll click on set next tops.

124
04:58.400 --> 05:03.160
And for the next top, we want that to be 10 dot 34 dot 34 dot 33.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

124
04:58.400 --> 05:03.160
And for the next top, we want that to be 10 dot 34 dot 34 dot 33.

125
05:03.160 --> 05:05.160
And let's confirm our topology real quick.

126
05:05.160 --> 05:09.920
And that is the IP address right here on this logical network between the tier

127
05:09.920 --> 05:10.600
zero at site

128
05:10.600 --> 05:12.280
four and the tier zero at site three.

129
05:12.280 --> 05:13.280
So that looks good.

130
05:13.280 --> 05:18.000
And it's also set the scope here for just the two site three IP, site VPN

131
05:18.000 --> 05:18.920
session.

132
05:18.920 --> 05:20.760
And then we'll click on add.

133
05:20.760 --> 05:25.240
And then we'll click on apply and save and close.

134
05:25.240 --> 05:27.280
And then we'll click on close editing.

135
05:27.280 --> 05:31.840
And let's also go to the CLI on the active edge node over at site four to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

135
05:27.280 --> 05:31.840
And let's also go to the CLI on the active edge node over at site four to

136
05:31.840 --> 05:32.600
verify its

137
05:32.600 --> 05:33.600
route as well.

138
05:33.600 --> 05:36.370
So as far as which device that is, let's go ahead and take a look at the

139
05:36.370 --> 05:37.920
network topology.

140
05:37.920 --> 05:40.520
We'll go ahead to our site for tier zero gateway.

141
05:40.520 --> 05:41.960
We'll double click on it.

142
05:41.960 --> 05:45.960
And that confirms for us here that it's edge two, which is the active note.

143
05:45.960 --> 05:49.520
And if we click on edge to there, it'll show us that its management address is

144
05:49.520 --> 05:50.400
dot 67.

145
05:50.400 --> 05:53.720
So let's do an SSH session over to dot 67.

146
05:53.720 --> 05:58.160
So here we are at edge two, all typing get gateways just to find the VRF that's

147
05:58.160 --> 05:58.560
being

148
05:58.560 --> 06:02.700
used by the services router and which is VRF one, so we'll type in VRF space
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

148
05:58.560 --> 06:02.700
used by the services router and which is VRF one, so we'll type in VRF space

149
06:02.700 --> 06:03.240
one, press

150
06:03.240 --> 06:06.360
enter and then let's do a get route and press enter.

151
06:06.360 --> 06:09.570
And we just want to confirm here we have our static route for the 1033 anything

152
06:09.570 --> 06:09.800
with

153
06:09.800 --> 06:12.960
the next top of 1034, 3433, which we do.

154
06:12.960 --> 06:13.960
That's great.

155
06:13.960 --> 06:17.560
And from right here, we should be able to ping some IP address over at the 1033

156
06:17.560 --> 06:18.000
address

157
06:18.000 --> 06:19.000
base.

158
06:19.000 --> 06:21.320
Let's do a ping to 10 dot 33 dot 0 dot one.

159
06:21.320 --> 06:24.240
That's cheating a little bit because we know that address exists.

160
06:24.240 --> 06:28.040
That's the interface address for that logical segment over on the left hand

161
06:28.040 --> 06:28.480
side.

162
06:28.480 --> 06:32.460
We saw that as the default gateway address that our red VM used for its first
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

162
06:28.480 --> 06:32.460
We saw that as the default gateway address that our red VM used for its first

163
06:32.460 --> 06:32.920
top.

164
06:32.920 --> 06:35.440
So if we press enter and sure enough, we can reach that.

165
06:35.440 --> 06:36.440
That looks good.

166
06:36.440 --> 06:40.230
So now that we've configured the details for our site to site route based VPN

167
06:40.230 --> 06:40.800
and we've

168
06:40.800 --> 06:45.500
also now implemented routing, our next logical step is to verify whether or not

169
06:45.500 --> 06:46.160
these VMs

170
06:46.160 --> 06:50.500
on the 1033 network and 1044 network respectively, whether or not they can

171
06:50.500 --> 06:51.520
actually reach each

172
06:51.520 --> 06:52.520
other.

173
06:52.520 --> 06:55.660
So we'll do that verification and also some additional CLI verification in the

174
06:55.660 --> 06:56.280
very next

175
06:56.280 --> 06:57.280
video.

176
06:57.280 --> 06:58.660
there in just a moment.