WEBVTT

1
00:00.000 --> 00:03.190
One of the really cool things about networking is that once we have an

2
00:03.190 --> 00:04.180
objective in mind,

3
00:04.180 --> 00:07.660
sometimes there's like two or three different ways of accomplishing that.

4
00:07.660 --> 00:11.960
So if we had three sites, for example, sites three, four and five here,

5
00:11.960 --> 00:14.480
and we had some VMs at each of those sites,

6
00:14.480 --> 00:16.640
and we wanted to enter communications between them.

7
00:16.640 --> 00:19.240
For example, this VM could talk to this VM,

8
00:19.240 --> 00:22.900
and this VM could talk to this VM, as well as here and here.

9
00:22.900 --> 00:24.720
We have a few options for implementing that.

10
00:24.720 --> 00:27.840
One would be setting up NSX federations,

11
00:27.840 --> 00:32.400
and then having a stretched segment that all three of the sites could access,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:27.840 --> 00:32.400
and then having a stretched segment that all three of the sites could access,

12
00:32.400 --> 00:35.680
then we could place the VMs on that stretched segment, that would be one option

13
00:35.680 --> 00:35.680
.

14
00:35.680 --> 00:38.540
Or we could implement site-to-site VPNs, for example,

15
00:38.540 --> 00:42.000
between site three and site four, and between site four and site five,

16
00:42.000 --> 00:44.040
and also between site five and site three,

17
00:44.040 --> 00:47.230
and then place the correct routes on the Tier Zero gateways and provide the

18
00:47.230 --> 00:48.440
routing functionality.

19
00:48.440 --> 00:52.210
That would also allow the VMs at each site to communicate security or the

20
00:52.210 --> 00:52.940
public internet

21
00:52.940 --> 00:57.080
with each other by leveraging the IPs.x site-to-site VPNs that we set up.

22
00:57.080 --> 00:59.840
And in this guild, we're going to take a look at yet another way

23
00:59.840 --> 01:03.520
that we can allow devices at different geographical sites
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:59.840 --> 01:03.520
that we can allow devices at different geographical sites

24
01:03.520 --> 01:05.680
to be able to go ahead and communicate with each other,

25
01:05.680 --> 01:09.000
and that's by using a layer two VPNs.

26
01:09.000 --> 01:12.250
So let's imagine these three network segments, one at site three, one at site

27
01:12.250 --> 01:13.400
four, one at site five.

28
01:13.400 --> 01:18.450
Let's imagine that we want to go ahead and have a logical, one giant, layer two

29
01:18.450 --> 01:19.400
broadcast domain

30
01:19.400 --> 01:22.960
that is shared by site three, site four, and site five.

31
01:22.960 --> 01:26.400
So here's what we could do. We could take those three overlay segments,

32
01:26.400 --> 01:28.760
one at site three, one at site four, one at site five.

33
01:28.760 --> 01:31.760
So to begin with, these are all isolated from each other.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

33
01:28.760 --> 01:31.760
So to begin with, these are all isolated from each other.

34
01:31.760 --> 01:35.160
Think of them like little islands with their VMs that are attached.

35
01:35.160 --> 01:37.880
However, what we can do is set up layer two VPNs,

36
01:37.880 --> 01:42.040
and we can logically create one shared segment.

37
01:42.040 --> 01:45.520
That, when each of the VMs at the respective sites connected at segment,

38
01:45.520 --> 01:49.640
they're all on the same logical layer two broadcast domain,

39
01:49.640 --> 01:54.080
as well as a corresponding common layer three IP network address space.

40
01:54.080 --> 01:56.830
And the big picture regarding how this works is we're going to set up one of

41
01:56.830 --> 01:57.440
our sites

42
01:57.440 --> 02:01.360
as a layer two VPN server.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
01:57.440 --> 02:01.360
as a layer two VPN server.

43
02:01.360 --> 02:02.920
In fact, let's go ahead and color code that.

44
02:02.920 --> 02:07.000
And let's imagine that site three, we're going to set up as the layer two VPN

45
02:07.000 --> 02:07.640
server.

46
02:07.640 --> 02:12.320
So put that right here, site three is going to be the L two VPN server.

47
02:12.320 --> 02:15.320
And then we have a couple other sites, site four and site five.

48
02:15.320 --> 02:17.200
So let me put site four right here.

49
02:17.200 --> 02:20.840
And site four will act as an L two VPN client.

50
02:20.840 --> 02:24.930
So we'll put site four right there and then for site five, which I'll put right

51
02:24.930 --> 02:25.400
here.

52
02:25.400 --> 02:29.760
And then we set up an L two VPN session between the server at site three and

53
02:29.760 --> 02:31.400
the client at site four.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
02:29.760 --> 02:31.400
the client at site four.

54
02:31.400 --> 02:35.080
Then we also set up a second L two VPN session between the server.

55
02:35.080 --> 02:39.000
Once again, at site three and the client here at site five.

56
02:39.000 --> 02:42.640
Now, to pull this off, there's virtual tunnel interfaces that are created

57
02:42.640 --> 02:44.600
at the server and at the clients.

58
02:44.600 --> 02:47.160
And there's a logical network set up between them.

59
02:47.160 --> 02:50.360
So behind the scenes, it's using GRE for that.

60
02:50.360 --> 02:55.470
So the yellow here represents the L two VPN session and the green represents

61
02:55.470 --> 02:57.720
the virtual tunnel interfaces

62
02:57.720 --> 03:01.640
that are the termination point for the logical network between the server and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
02:57.720 --> 03:01.640
that are the termination point for the logical network between the server and

63
03:01.640 --> 03:02.440
the clients.

64
03:02.440 --> 03:05.240
And then to tie all this together, we're going to take each of these segments

65
03:05.240 --> 03:08.440
and we're going to associate them with our layer two VPN service.

66
03:08.440 --> 03:12.470
So this segment over here can be called site, for example, called site three

67
03:12.470 --> 03:13.960
segment 99.

68
03:13.960 --> 03:15.640
It's just a locally significant name.

69
03:15.640 --> 03:20.440
And then over here at site four, we could call this S four segment 99.

70
03:20.440 --> 03:25.080
And over here at site five, we call it S five dash SAG 99.

71
03:25.080 --> 03:28.040
So it's just a local segment and a local name at each of the sites.

72
03:28.040 --> 03:32.440
But it's the linking it to the layer two VPN service, which causes these three
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
03:28.040 --> 03:32.440
But it's the linking it to the layer two VPN service, which causes these three

73
03:32.440 --> 03:33.560
separate segments

74
03:33.560 --> 03:38.520
at each or three sites to logically become one layer two broadcast domain.

75
03:38.520 --> 03:41.590
So on top of that entire network address space, let's say we want to use the

76
03:41.590 --> 03:45.240
addressing space of 10 dot 99 dot zero dot zero with eight

77
03:45.240 --> 03:49.000
24 bit mask. And as far as D should be services go, we can set up D should be

78
03:49.000 --> 03:52.040
services at one site or all three sites.

79
03:52.040 --> 03:55.000
And then for that common segment, we could have a default gateway, for example,

80
03:55.000 --> 03:55.880
at top one,

81
03:55.880 --> 04:00.870
then any VMs we place on the segment over at site three or on a segment over at
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
03:55.880 --> 04:00.870
then any VMs we place on the segment over at site three or on a segment over at

82
04:00.870 --> 04:01.560
site four.

83
04:01.560 --> 04:06.200
Effectively, they're always sitting on that same layer two broadcast domain and

84
04:06.200 --> 04:09.000
on the same IP subnet of 10 99 zero.

85
04:09.000 --> 04:13.210
So our tunnels between the sites would be from the server here at site three

86
04:13.210 --> 04:14.200
over to site four.

87
04:14.200 --> 04:17.540
And another tunnel over to site five. Now, one of the things we want to avoid

88
04:17.540 --> 04:20.680
doing whenever possible is the send sensitive data,

89
04:20.680 --> 04:25.090
including packets containing sensitive data over an untrusted network, such as

90
04:25.090 --> 04:25.880
the internet.

91
04:25.880 --> 04:30.490
So also, as part of the implementation of our L2 VPNs, it's also going to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
04:25.880 --> 04:30.490
So also, as part of the implementation of our L2 VPNs, it's also going to

92
04:30.490 --> 04:31.880
implement IP sec.

93
04:31.880 --> 04:36.190
So as traffic is being sent back and forth between these sites behind the

94
04:36.190 --> 04:40.920
scenes, IP sec is being leveraged as part of the layer two VPNs to protect the

95
04:40.920 --> 04:41.960
packets as they're being sent.

96
04:41.960 --> 04:45.880
So from this public networks perspective, if they were to capture the traffic,

97
04:45.880 --> 04:50.880
all they would see is ESP traffic that's being sent between the endpoints at

98
04:50.880 --> 04:51.400
site three,

99
04:51.400 --> 04:55.520
for example, in site four or between site five and site three. And they wouldn

100
04:55.520 --> 04:59.080
't have access to any of the encrypted payload information because they wouldn't

101
04:59.080 --> 05:01.880
have the keys to unlock that data and make sense of it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
04:59.080 --> 05:01.880
have the keys to unlock that data and make sense of it.

102
05:01.880 --> 05:06.960
So with layer two VPNs, we can take segments on each of our sites and logically

103
05:06.960 --> 05:10.520
create one giant broadcast domain, but it's not limited to overlay segments.

104
05:10.520 --> 05:16.140
We can also include VLANs or a combination of VLANs and overlay segments and

105
05:16.140 --> 05:20.780
merge them together into one giant broadcast domain by linking them to the L2

106
05:20.780 --> 05:21.800
VPN service.

107
05:21.800 --> 05:26.420
So having this feature called the layer two VPNs in the NSX environment is a

108
05:26.420 --> 05:27.880
super useful tool.

109
05:27.880 --> 05:32.840
If we ever need to combine VLANs and or overlay segments across multiple
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
05:27.880 --> 05:32.840
If we ever need to combine VLANs and or overlay segments across multiple

110
05:32.840 --> 05:36.880
geographic sites and have them appear as one logical network.

111
05:36.880 --> 05:40.310
So to really appreciate this, one of the best things to do is to see it in

112
05:40.310 --> 05:40.880
action.

113
05:40.880 --> 05:44.400
So in the next video, let's take a moment and let's put a game plan together

114
05:44.400 --> 05:48.890
specifically for what we want to accomplish with layer two VPNs and then with a

115
05:48.890 --> 05:49.880
game plan in place.

116
05:49.880 --> 05:54.800
We'll then proceed to the configuration and verification of layer two VPNs in

117
05:54.800 --> 05:56.320
an NSX environment.

118
05:56.320 --> 05:59.320
So I'll see you in the next video for the game plan.

119
05:59.320 --> 06:07.280
[BLANK_AUDIO]
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
05:59.320 --> 06:07.280
[BLANK_AUDIO]