WEBVTT

1
00:00.000 --> 00:01.880
With our topology confirmed,

2
00:01.880 --> 00:06.720
let's begin our configuration of layer 2 VPNs starting here at our L2 VPN

3
00:06.720 --> 00:07.240
server,

4
00:07.240 --> 00:11.880
which is going to be implemented here on our T0 gateway at Site 3.

5
00:11.880 --> 00:13.440
As part of that process,

6
00:13.440 --> 00:15.960
we'll enable two VPN services,

7
00:15.960 --> 00:19.320
one for IPsec, one for L2 VPN in server mode.

8
00:19.320 --> 00:22.160
Once those services are enabled here at the T0 gateway,

9
00:22.160 --> 00:27.840
we'll then proceed to configuring an L2 VPN session between Site 3 and Site 4.

10
00:27.840 --> 00:31.520
As part of that is going to ask us about what is the logical network address
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:27.840 --> 00:31.520
As part of that is going to ask us about what is the logical network address

11
00:31.520 --> 00:32.560
space we want to use

12
00:32.560 --> 00:37.730
for the virtual tunnel interfaces and the logical network between, for example,

13
00:37.730 --> 00:39.040
Site 3 and Site 4.

14
00:39.040 --> 00:45.270
So, for the addressing, let's use 1.22.16.99.30 with a 28-bit mask here at Site

15
00:45.270 --> 00:45.680
3.

16
00:45.680 --> 00:48.920
Then, when we configure Site 4 as an L2 VPN client,

17
00:48.920 --> 00:52.510
it'll go ahead and automatically assign one of the IP addresses from that same

18
00:52.510 --> 00:53.000
subnet.

19
00:53.000 --> 00:57.440
So, this is the subnet 16 with the range of 17 all the way through 30.

20
00:57.440 --> 01:01.400
And we're just using the last IP address in that subnet here on the T0 gateway
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
00:57.440 --> 01:01.400
And we're just using the last IP address in that subnet here on the T0 gateway

21
01:01.400 --> 01:02.240
at Site 3

22
01:02.240 --> 01:05.120
for this end of the tunnel, for this VTI right here.

23
01:05.120 --> 01:07.120
And as I mentioned, when we get to Site 4,

24
01:07.120 --> 01:10.910
it'll go ahead and dynamically assign an IP address from that same subnet for

25
01:10.910 --> 01:12.240
that end of the tunnel.

26
01:12.240 --> 01:16.800
All right, so let's head over to the NSX manager over here at Site 3.

27
01:16.800 --> 01:19.360
So, here at the Site 3 NSX manager,

28
01:19.360 --> 01:22.990
let's go to the networking tab up on top and on the left, under network

29
01:22.990 --> 01:23.360
services,

30
01:23.360 --> 01:25.280
we'll click right here on VPN.

31
01:25.280 --> 01:28.320
So, our first task is to create two VPN services,

32
01:28.320 --> 01:32.240
one to support IPsec, which is being used by our LTVPans.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

32
01:28.320 --> 01:32.240
one to support IPsec, which is being used by our LTVPans.

33
01:32.240 --> 01:35.630
And then the second service we're going to create is for the LTVPans service

34
01:35.630 --> 01:36.320
itself.

35
01:36.320 --> 01:39.600
So, we'll click right here on add service at Site 3.

36
01:39.600 --> 01:41.360
And let's create the IPsec service first.

37
01:41.360 --> 01:43.760
So, we'll select IPsec from the dropdown,

38
01:43.760 --> 01:46.880
and then I'll collapse the left-hand side to give us a little bit more room.

39
01:46.880 --> 01:51.200
And let's call this Site 3 IPsec for this VPN service for IPsec.

40
01:51.200 --> 01:54.160
We'll associate this service with our T0 gateway.

41
01:54.160 --> 01:57.680
And then we'll leave everything else to their defaults and click on save.

42
01:57.680 --> 02:00.400
And we'll click on no, and let's create one more service.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
01:57.680 --> 02:00.400
And we'll click on no, and let's create one more service.

43
02:00.400 --> 02:03.520
And that's going to be our LTVPans service.

44
02:03.520 --> 02:07.190
So, with VPN services still selected, we'll click once again here on add

45
02:07.190 --> 02:07.760
service.

46
02:07.760 --> 02:11.520
This time from the dropdown, we're going to choose the LTVPans server.

47
02:11.520 --> 02:12.640
So, we'll click on that.

48
02:12.640 --> 02:14.960
We'll call this Site 3 LTVPans.

49
02:14.960 --> 02:19.120
Associate that service also with our Tier 0 gateway here at Site 3.

50
02:19.120 --> 02:21.360
So, the hub and spoke is disabled by default.

51
02:21.360 --> 02:26.480
But if we want to connect, for example, two or more LTVPans clients,

52
02:26.480 --> 02:30.560
and we want all those client computers on those LTVP and connected segments
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
02:26.480 --> 02:30.560
and we want all those client computers on those LTVP and connected segments

53
02:30.560 --> 02:32.320
to be able to communicate with each other,

54
02:32.320 --> 02:36.620
we need to propagate any of those messages from one segment to the other spokes

55
02:36.620 --> 02:36.800
.

56
02:36.800 --> 02:39.600
So, if we enable hub and spoke, that'll allow that to happen,

57
02:39.600 --> 02:43.680
to create one giant layer to broadcast domain across the server,

58
02:43.680 --> 02:48.080
and all of the spokes with segments associated with the LTVPans.

59
02:48.080 --> 02:50.400
So, I'm going to set the hub and spoke to enabled,

60
02:50.400 --> 02:53.600
and then take all the other defaults, and then we'll click on save.

61
02:53.600 --> 02:54.960
So, we'll click on node.

62
02:54.960 --> 02:58.880
So, now here in the VPN section on Site 3 and NSX Manager,

63
02:58.880 --> 03:05.280
with VPN services selected, we have two VPN services, IPsec, and one for L2VPN.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
02:58.880 --> 03:05.280
with VPN services selected, we have two VPN services, IPsec, and one for L2VPN.

64
03:05.280 --> 03:08.400
We can also confirm that by going to our network topology.

65
03:08.400 --> 03:11.680
And then here at our T0 gateway, we hover over services.

66
03:11.680 --> 03:14.480
You'll notice it has two VPN services.

67
03:14.480 --> 03:17.280
One of those is the IPsec, and the other is the L2VPN.

68
03:17.280 --> 03:21.440
Think of it like the gateway being willing to support those services.

69
03:21.440 --> 03:25.300
Now, they're not really going to be used until we set up sessions regarding

70
03:25.300 --> 03:25.760
them.

71
03:25.760 --> 03:29.840
So, let's go back over to the VPN section here on Site 3.

72
03:29.840 --> 03:34.320
And with VPN selected, let's go to our next section right here, L2VPN session.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
03:29.840 --> 03:34.320
And with VPN selected, let's go to our next section right here, L2VPN session.

73
03:34.320 --> 03:37.920
So, also behind the scenes, what's really important to be aware of is that,

74
03:37.920 --> 03:43.920
when we set up an L2VPN session, it's also going to create an IPsec session

75
03:43.920 --> 03:46.000
to protect the traffic going back and forth.

76
03:46.000 --> 03:49.200
So, right here, if we go to IPsec sessions, there's nothing here yet.

77
03:49.200 --> 03:52.800
But when we go through the process of creating an L2VPN session,

78
03:52.800 --> 03:56.880
it's automatically going to create an IPsec session as well.

79
03:56.880 --> 04:00.160
So, be prepared for that to show up right here once we're done with config.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:56.880 --> 04:00.160
So, be prepared for that to show up right here once we're done with config.

80
04:00.160 --> 04:05.520
So, with L2VPN session selected, we'll click right here on Add L2VPN session.

81
04:05.520 --> 04:08.640
And then from the dropdown, because the Site 3 is going to be the server,

82
04:08.640 --> 04:11.760
and we enabled the VPN service for our L2VPN server,

83
04:11.760 --> 04:13.840
we're going to choose that type of session.

84
04:13.840 --> 04:19.550
So, we'll choose from the dropdown L2VPN server, and we'll call the Site 3 L2

85
04:19.550 --> 04:20.800
VPN server,

86
04:20.800 --> 04:24.160
just like that. And it's server mode based on what we chose from the dropdown.

87
04:24.160 --> 04:27.840
And now it's asking us, "Hey, what service do you want to associate this with?"

88
04:27.840 --> 04:32.680
And we want to associate this with the VPN service for L2VPN that we created
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
04:27.840 --> 04:32.680
And we want to associate this with the VPN service for L2VPN that we created

89
04:32.680 --> 04:33.200
earlier.

90
04:33.200 --> 04:38.080
So, we'll choose that single option, Site 3 L2VPN VPN service.

91
04:38.080 --> 04:39.840
Then we're going to specify the local endpoint.

92
04:39.840 --> 04:43.040
So, here on Site 3, because we deleted our local endpoints,

93
04:43.040 --> 04:46.530
we can go ahead and simply create another one by clicking on the three dots

94
04:46.530 --> 04:47.440
right here.

95
04:47.440 --> 04:52.730
And here at Site 3, the local endpoint is going to be our globally reachable IP

96
04:52.730 --> 04:53.280
address,

97
04:53.280 --> 04:56.160
which is 23.1.2.30.

98
04:56.160 --> 04:58.400
So, we'll click here on Add Local Endpoint.

99
04:58.400 --> 05:01.600
I'm going to go ahead and name this 23.1.2.30.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
04:58.400 --> 05:01.600
I'm going to go ahead and name this 23.1.2.30.

100
05:01.600 --> 05:04.880
That way, when I see the name or the address, it'll be the same.

101
05:04.880 --> 05:08.880
And then for the actual endpoint address, I'll put 23.1.2.30.

102
05:08.880 --> 05:10.720
And then I'm not using any certificates.

103
05:11.280 --> 05:14.880
And for the local ID, we could also plug in that IP address again.

104
05:14.880 --> 05:19.190
However, if we leave the local ID blank, it'll just use that IP address that we

105
05:19.190 --> 05:20.000
're using

106
05:20.000 --> 05:22.640
as the local endpoint for the local ID as well.

107
05:22.640 --> 05:26.000
So, I'm going to go ahead and just let that assume that IP address right there

108
05:26.000 --> 05:27.360
for the local ID.

109
05:27.360 --> 05:30.320
And as part of configuring this local endpoint, check this out.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
05:27.360 --> 05:30.320
And as part of configuring this local endpoint, check this out.

110
05:30.320 --> 05:32.960
It's asking what VPN service we'd associate this with.

111
05:32.960 --> 05:35.120
And this is our Site 3 IPsec.

112
05:35.120 --> 05:39.680
So, this endpoint is going to be used as part of an IPsec tunnel in combination

113
05:39.680 --> 05:41.120
with the L2 VPN.

114
05:41.120 --> 05:44.080
And that way, it's going to be using IPsec to protect the traffic going back

115
05:44.080 --> 05:44.640
and forth.

116
05:44.640 --> 05:46.000
So, we'll click on Save.

117
05:46.000 --> 05:49.280
So, here's the name of our L2 VPN session.

118
05:49.280 --> 05:51.120
Here's the mode, which is Server.

119
05:51.120 --> 05:54.160
Here's the VPN service that we're using to support it.

120
05:54.160 --> 05:57.280
Then we're using this local endpoint of 23.1.2.30.

121
05:57.280 --> 06:02.480
And then for Site 4, the remote IP address is going to be 24.1.2.40.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
05:57.280 --> 06:02.480
And then for Site 4, the remote IP address is going to be 24.1.2.40.

122
06:02.480 --> 06:05.040
In fact, let's take a look at our topology just to confirm.

123
06:05.040 --> 06:09.920
So, here in our topology, we want to appear with 24.1.2.40.

124
06:09.920 --> 06:13.970
So, that's what we'll put in as the remote IP address from the perspective of

125
06:13.970 --> 06:14.640
Site 3.

126
06:14.640 --> 06:16.960
So, we'll put in 21.2.40.

127
06:16.960 --> 06:17.840
Fantastic.

128
06:17.840 --> 06:21.440
And we're also going to be using a pre-shared key for the authentication part

129
06:21.440 --> 06:22.400
of the tunnel.

130
06:22.400 --> 06:24.240
So, I'm simply going to put in a passphrase there.

131
06:24.240 --> 06:26.880
And if we click on the eyeball, I'll show you what I put in Cisco,

132
06:26.880 --> 06:29.520
Exclamation Mark 2.3 with the capital C at the beginning.

133
06:29.520 --> 06:32.360
And that's the pre-shared key that's going to be used behind the scenes with IP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

133
06:29.520 --> 06:32.360
And that's the pre-shared key that's going to be used behind the scenes with IP

134
06:32.360 --> 06:32.640
sec

135
06:32.640 --> 06:35.440
for the authentication of the tunnel.

136
06:35.440 --> 06:38.720
And then for the remote ID, we can just leave that blank if we want to,

137
06:38.720 --> 06:41.840
because it'll just pull by default the remote IP address,

138
06:41.840 --> 06:43.920
up here 24.1.2.40.

139
06:43.920 --> 06:46.480
And it'll use that for the corresponding remote ID.

140
06:46.480 --> 06:50.560
And then over here on the right, it's asking us for the tunnel interface.

141
06:50.560 --> 06:54.560
So, once again, we're creating a virtual tunnel interface,

142
06:54.560 --> 06:59.600
an illogical IP network segment between us here at Site 3

143
06:59.600 --> 07:04.560
and the destination for this L2 VPN session, which is over at Site 4.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

143
06:59.600 --> 07:04.560
and the destination for this L2 VPN session, which is over at Site 4.

144
07:04.560 --> 07:07.760
So, for that virtual tunnel interface, I would like to use this IP address,

145
07:07.760 --> 07:11.040
172.16.99.30 with this last 28.

146
07:11.040 --> 07:15.440
And so, the range of that subnet is 17, as far as usable addresses,

147
07:15.440 --> 07:16.720
all the way through 30.

148
07:16.720 --> 07:19.520
So, let's put in this IP address right here for the virtual tunnel interface

149
07:19.520 --> 07:21.600
that we're going to be using at Site 3.

150
07:21.600 --> 07:23.920
So, there is the tunnel IP address that we want to use.

151
07:23.920 --> 07:26.400
And the cool thing is, when we configure a client,

152
07:26.400 --> 07:30.160
it'll automatically pull an IP address from that same subnet
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

152
07:26.400 --> 07:30.160
it'll automatically pull an IP address from that same subnet

153
07:30.160 --> 07:33.920
to be used on the client side of that logical network connection.

154
07:33.920 --> 07:35.840
And then we'll go ahead and click on Save.

155
07:35.840 --> 07:37.680
It's asking if we want to continue configuring.

156
07:37.680 --> 07:39.280
I'll go ahead and say no to that.

157
07:39.280 --> 07:43.040
So, now we have this L2 VPN session created and check it out.

158
07:43.040 --> 07:46.880
Behind the scenes, it also created for us an IP [garbled] session

159
07:46.880 --> 07:48.480
over to that same destination.

160
07:48.480 --> 07:51.120
And it's using the IPsec to protect the traffic.

161
07:51.120 --> 07:54.480
So, when you set up an L2 VPN session, think of it like a two-for-one.

162
07:54.480 --> 07:58.560
We have the L2 VPN session as well as a corresponding IPsec session.

163
07:58.560 --> 08:02.000
Now, at the moment, it shows as down, do-be-do-down, down.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

163
07:58.560 --> 08:02.000
Now, at the moment, it shows as down, do-be-do-down, down.

164
08:02.000 --> 08:05.360
And that's because we haven't yet configured the other side.

165
08:05.360 --> 08:08.720
And when I say other side, I mean, we haven't configured yet any clients.

166
08:08.720 --> 08:12.140
So, in the next video, let's continue our configuration by moving over to Site

167
08:12.140 --> 08:12.560
4

168
08:12.560 --> 08:17.360
and configuring it with two VPN services, one for IPsec, one for L2 VPN,

169
08:17.360 --> 08:18.720
but this time client mode.

170
08:18.720 --> 08:21.520
And then we'll proceed to configure an L2 VPN session

171
08:21.520 --> 08:24.480
from Site 4 going over back to Site 3.

172
08:24.480 --> 08:27.920
So, I'll see you in the next video as we begin the configuration here

173
08:27.920 --> 08:29.680
on Site 4 as a client.