WEBVTT

1
00:00.000 --> 00:04.300
So when we left off, we had configured Site 3 as an L2 VPN server,

2
00:04.300 --> 00:06.600
and now we're going to turn our attention to Site 4 here,

3
00:06.600 --> 00:12.160
and it's Tier 0 gateway to configure Site 4 as an L2 VPN client.

4
00:12.160 --> 00:15.000
So let's head over to the NSX Manager here at Site 4,

5
00:15.000 --> 00:19.000
and for convenience sake and also for determining which one we're on,

6
00:19.000 --> 00:22.500
I've also set up Site 4 NSX Manager in dark mode,

7
00:22.500 --> 00:24.800
while Site 3 is currently in light mode.

8
00:24.800 --> 00:26.240
All right, so here we go.

9
00:26.240 --> 00:27.200
This is Site 4.

10
00:27.200 --> 00:30.900
If we go to the Networking tab for the NSX Manager here at Site 4,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:27.200 --> 00:30.900
If we go to the Networking tab for the NSX Manager here at Site 4,

11
00:30.900 --> 00:33.400
and let's just take a look at our network topology to start off with.

12
00:33.400 --> 00:35.000
So we'll click on Network Topology,

13
00:35.000 --> 00:39.700
and currently we have our Tier 0 gateway right here with three services running

14
00:39.700 --> 00:39.700
.

15
00:39.700 --> 00:43.300
None of those are VPNs, so let's go ahead and start the configuration

16
00:43.300 --> 00:47.100
by creating a couple of VPN services here at Site 4,

17
00:47.100 --> 00:50.600
one for IPsec and the other four L2 VPN.

18
00:50.600 --> 00:54.000
So to do that, on the left-hand side with Networking still selected at the top,

19
00:54.000 --> 00:55.900
on the left-hand side, under Network Services,

20
00:55.900 --> 00:58.300
we'll click right here on VPN.

21
00:58.300 --> 01:00.900
And let me go ahead and collapse this left-hand side.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:58.300 --> 01:00.900
And let me go ahead and collapse this left-hand side.

22
01:00.900 --> 01:03.600
This will remind us exactly where we're at right there.

23
01:03.600 --> 01:06.000
And let's create our two VPN services that we're going to need.

24
01:06.000 --> 01:09.300
So we'll create the first one, and it really doesn't matter which order you do

25
01:09.300 --> 01:09.600
these in,

26
01:09.600 --> 01:12.700
but they do both have to exist before we set up the L2 VPN session.

27
01:12.700 --> 01:18.000
So let's do the IPsec first, and we'll go ahead and call this one Site 4 IPsec.

28
01:18.000 --> 01:19.900
And for the gateway we're going to associate this with,

29
01:19.900 --> 01:21.400
we're going to go ahead and select our only gateway,

30
01:21.400 --> 01:24.600
which is our Tier 0 gateway, and click on Save.

31
01:24.600 --> 01:28.100
And then we'll go ahead and do that once more, but this time for the L2 VPN.

32
01:28.100 --> 01:33.300
But this time at Site 4, we're going to choose the L2 VPN client VPN service.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

32
01:28.100 --> 01:33.300
But this time at Site 4, we're going to choose the L2 VPN client VPN service.

33
01:33.300 --> 01:35.700
And we'll call the Site 4 L2 client.

34
01:35.700 --> 01:37.800
And then for the gateway we want to associate this with,

35
01:37.800 --> 01:40.500
once again, those come here, Tier 0 gateway at Site 4,

36
01:40.500 --> 01:42.000
and we'll click on Save.

37
01:42.000 --> 01:43.300
Then we'll click on No.

38
01:43.300 --> 01:46.300
And now we have our two VPN services, one for IPsec,

39
01:46.300 --> 01:48.000
one for the L2 VPN client.

40
01:48.000 --> 01:51.280
And then we're going to move over to L2 VPN sessions and begin our

41
01:51.280 --> 01:51.900
configuration.

42
01:51.900 --> 01:54.930
Now, very similar to what we did at the server, if we go back here to IPsec

43
01:54.930 --> 01:55.400
sessions,

44
01:55.400 --> 01:56.700
there's nothing here yet.

45
01:56.700 --> 01:59.700
But once we're done with the config of our L2 VPN sessions,

46
01:59.700 --> 02:04.100
we're going to have our L2 VPN session from Site 4 over to Site 3.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

46
01:59.700 --> 02:04.100
we're going to have our L2 VPN session from Site 4 over to Site 3.

47
02:04.100 --> 02:06.500
And we're also going to have a corresponding IPsec session

48
02:06.500 --> 02:10.670
that's being used to protect and encrypt our traffic as it's going between Site

49
02:10.670 --> 02:12.100
4 and Site 3.

50
02:12.100 --> 02:17.500
So with L2 VPN session selected, let's click on Add L2 VPN session.

51
02:17.500 --> 02:22.000
And then from the dropdown, because we enabled a VPN service of L2 VPN client,

52
02:22.000 --> 02:24.400
and that's what we want Site 4 to be from the dropdown,

53
02:24.400 --> 02:27.200
we'll choose L2 VPN client right there.

54
02:27.200 --> 02:30.000
And then I call this L2 to Site 3.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
02:30.000 --> 02:32.900
And it'll just remind me when I see this session, what it's doing.

56
02:32.900 --> 02:37.500
So this is the L2 VPN session over to Site 3, and we're in client mode.

57
02:37.500 --> 02:41.100
And for the VPN service, we're going to associate this with the VPN service

58
02:41.100 --> 02:43.000
called Site 4 L2 client.

59
02:43.000 --> 02:45.600
That's our local endpoint here at Site 4.

60
02:45.600 --> 02:49.800
And then the remote endpoint is over at our server, and that's at Site 3.

61
02:49.800 --> 02:52.300
And that's at 23.1.2.30.

62
02:52.300 --> 02:56.000
And then check this out, the magic for the client happens here.

63
02:56.000 --> 03:00.400
Instead of having to put in all the additional details and the VGI information
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
02:56.000 --> 03:00.400
Instead of having to put in all the additional details and the VGI information

64
03:00.400 --> 03:01.200
and so forth,

65
03:01.200 --> 03:04.410
all we need to do for the L2 VPN session and what's going to be the

66
03:04.410 --> 03:06.000
corresponding IPsec session

67
03:06.000 --> 03:09.900
is put in the name, specify the service we're going to tie this to,

68
03:09.900 --> 03:14.100
the endpoints involved, and then we are going to copy and paste

69
03:14.100 --> 03:16.500
the peer configuration from the server.

70
03:16.500 --> 03:20.600
So right here, we're going to go ahead and right click and then paste the

71
03:20.600 --> 03:21.800
exported information

72
03:21.800 --> 03:23.600
from the server regarding the peer config.

73
03:23.600 --> 03:27.700
So because I don't yet have that in my buffer, let's go back over to the server

74
03:27.700 --> 03:29.700
just for a moment at Site 3.

75
03:29.700 --> 03:33.760
And let's download the information we need so we can paste it in right here on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
03:29.700 --> 03:33.760
And let's download the information we need so we can paste it in right here on

76
03:33.760 --> 03:34.500
the client.

77
03:34.500 --> 03:37.700
So just to make sure that you and I are on the same page here, we are currently

78
03:37.700 --> 03:38.600
at Site 4.

79
03:38.600 --> 03:41.830
We're going to hop over to Site 3 just for a moment, get the information we

80
03:41.830 --> 03:43.200
need, put it in my buffer,

81
03:43.200 --> 03:45.800
and then paste it in over here at the client.

82
03:45.800 --> 03:49.500
So back here at Site 3, we're going to click on the networking tab on the left.

83
03:49.500 --> 03:54.000
We're going to go down to VPN under network services and we're going to go to

84
03:54.000 --> 03:56.000
our L2 VPN sessions.

85
03:56.000 --> 04:01.520
And here's our session from the perspective of Site 3 that's going over to Site
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

85
03:56.000 --> 04:01.520
And here's our session from the perspective of Site 3 that's going over to Site

86
04:01.520 --> 04:01.800
4.

87
04:01.800 --> 04:07.100
So here, if we expand the details on Site 3 for our L2 VPN server,

88
04:07.100 --> 04:10.000
right here, there's an option to download config.

89
04:10.000 --> 04:13.600
And so the little pop-up help says remote site VPN configuration.

90
04:13.600 --> 04:16.860
So if we click here on download config, it's going to include that peer

91
04:16.860 --> 04:17.400
information

92
04:17.400 --> 04:21.500
that we can just plug in over to the client and be done with our config.

93
04:21.500 --> 04:24.400
So I'm going to click right here on download config from the server.

94
04:24.400 --> 04:27.500
And this is warning me that the pre shared key is going to be in this.

95
04:27.500 --> 04:32.070
And as a result, we might want to keep this file secure and then I'll click on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
04:27.500 --> 04:32.070
And as a result, we might want to keep this file secure and then I'll click on

96
04:32.070 --> 04:32.500
yes.

97
04:32.500 --> 04:36.400
So here in my browser, I configured my browser to prompt me to specify where I

98
04:36.400 --> 04:37.700
want to download

99
04:37.700 --> 04:39.900
files that I download via my browser.

100
04:39.900 --> 04:43.500
So a lot of times this might just show up in your downloads folder or whatever

101
04:43.500 --> 04:45.100
your default download location is.

102
04:45.100 --> 04:49.010
So this is going to download to my downloads folder and the name is going to be

103
04:49.010 --> 04:52.400
L2 VPN session to site for config.txt.

104
04:52.400 --> 04:55.990
So I'll save that and then I'm going to go to my downloads folder and open that

105
04:55.990 --> 04:56.300
.

106
04:56.300 --> 05:01.460
So here is that file and what we want is the peer code and that is this right
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
04:56.300 --> 05:01.460
So here is that file and what we want is the peer code and that is this right

107
05:01.460 --> 05:02.000
here.

108
05:02.000 --> 05:05.100
So I'm going to go ahead and take everything inside of the quote.

109
05:05.100 --> 05:08.800
So not including the quote, the opening quote or closing quote, but everything

110
05:08.800 --> 05:09.700
in between there.

111
05:09.700 --> 05:13.290
I'm going to right click and copy that to my buffer and then I'm going to go

112
05:13.290 --> 05:17.700
over to site for and paste that in as the peer code.

113
05:17.700 --> 05:21.900
So minimize that and let's go back to site for which is still in dark mode.

114
05:21.900 --> 05:24.300
So this is the NSX manager in dark mode.

115
05:24.300 --> 05:28.500
We're still configuring the L2 VPN session going back to our server.

116
05:28.500 --> 05:32.080
And so right here, where it says peer configuration enter peer code, I'm going
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
05:28.500 --> 05:32.080
And so right here, where it says peer configuration enter peer code, I'm going

117
05:32.080 --> 05:36.400
to right click and simply paste that content in and then I'll click on safe.

118
05:36.400 --> 05:39.550
And then if we want to do further configuration, we can click on yes, but I

119
05:39.550 --> 05:40.700
want to click on no for now.

120
05:40.700 --> 05:44.950
And now we have this beautiful L2 VPN session configuration here at site for

121
05:44.950 --> 05:47.300
that goes back to site three to the server.

122
05:47.300 --> 05:48.300
Also check this out.

123
05:48.300 --> 05:52.550
If we click here on IP [garbled] sessions, it also in the background created for us

124
05:52.550 --> 05:56.440
and IP [garbled] session that's going to be used to encrypt and protect the packets

125
05:56.440 --> 06:01.200
as they go back and forth between site for and the server at site three.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

125
05:56.440 --> 06:01.200
as they go back and forth between site for and the server at site three.

126
06:01.200 --> 06:05.800
So here if we go back to L2 VPN sessions and expand this here, I have an alarm.

127
06:05.800 --> 06:09.900
Let me see what that alarm is and the alarm says the L2 VPN session was down.

128
06:09.900 --> 06:11.900
That was because we just barely created it.

129
06:11.900 --> 06:15.360
However, it's been up for a few moments now now showing that the status is

130
06:15.360 --> 06:15.800
success.

131
06:15.800 --> 06:19.330
And if we were to click on the IP [garbled] session information, click here on view

132
06:19.330 --> 06:23.500
statistics because it's a route based VPN that is set up for us.

133
06:23.500 --> 06:27.400
Anything going over the logical network is going to be encrypted.

134
06:27.400 --> 06:32.500
Also, just as a verification, let's go to our network topology.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

134
06:27.400 --> 06:32.500
Also, just as a verification, let's go to our network topology.

135
06:32.500 --> 06:36.600
Let's identify which of our two edge nodes is active by double clicking on our

136
06:36.600 --> 06:38.100
tier zero gateway here.

137
06:38.100 --> 06:41.800
And this shows that edge to is the active edge note.

138
06:41.800 --> 06:45.700
And if we click there, it'll confirm for us what the management IP addresses

139
06:45.700 --> 06:50.390
and I suggest just for a moment that we open up an S to say session over to dot

140
06:50.390 --> 06:55.360
67 to this active edge node, which is edge to just to take a look and confirm a

141
06:55.360 --> 06:56.500
few details together,

142
06:56.500 --> 07:00.520
including the fact that it has a virtual tunnel interface and we can also
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
06:56.500 --> 07:00.520
including the fact that it has a virtual tunnel interface and we can also

143
07:00.520 --> 07:03.200
identify what that virtual tunnel interface address is.

144
07:03.200 --> 07:08.560
So here we are connected via SSH over to edge to at lab four and let's do a get

145
07:08.560 --> 07:13.700
gateways and let's go to the VRF for services router, which is VRF one.

146
07:13.700 --> 07:18.000
So we'll type in VRF space one press enter and let's type in get interfaces.

147
07:18.000 --> 07:21.200
So let me scroll up to the top of that output right here.

148
07:21.200 --> 07:24.400
So here's the command get interfaces and those right here.

149
07:24.400 --> 07:30.500
We have a VTI virtual tunnel interface and the address is 172 16 99 dot 17.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
07:24.400 --> 07:30.500
We have a VTI virtual tunnel interface and the address is 172 16 99 dot 17.

150
07:30.500 --> 07:34.900
So it was automatically assigned an IP address from that subnet.

151
07:34.900 --> 07:40.800
So we use the subnet of once into 16 99 dot 16 with the slash 28 bit mask.

152
07:40.800 --> 07:45.650
We use dot 30 over at the server and I use dot 17 the first valid IP address on

153
07:45.650 --> 07:48.400
that subnet for the address on this end of the tunnel.

154
07:48.400 --> 07:51.730
So we should right here be able to ping the other side of the tunnel, which is

155
07:51.730 --> 07:54.900
once a two 16 99 dot 30 and that's over at the server.

156
07:54.900 --> 07:56.500
So let's verify that as well.

157
07:56.500 --> 08:03.070
So we'll do a ping over to once a two dot 16 dot 99 dot 30 press enter and sure
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

157
07:56.500 --> 08:03.070
So we'll do a ping over to once a two dot 16 dot 99 dot 30 press enter and sure

158
08:03.070 --> 08:05.300
enough that is working like a champ.

159
08:05.300 --> 08:09.910
Also, if we exit that VRF and let's do a get IP sec VPN and a space question

160
08:09.910 --> 08:12.300
mark and let's type in session and press enter.

161
08:12.300 --> 08:16.100
So there's our current IP [garbled] session that it built for us to protect later to

162
08:16.100 --> 08:17.100
VPN traffic.

163
08:17.100 --> 08:19.600
So here we have the endpoints for the tunnel.

164
08:19.600 --> 08:24.480
So anything that crosses over our tunnel interface, which is using that 172 dot

165
08:24.480 --> 08:26.000
16 dot 99, etc.

166
08:26.000 --> 08:28.300
address space, that's going to be encrypted.

167
08:28.300 --> 08:32.660
We can also get details on the layer to information with a get l two VPN space
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

167
08:28.300 --> 08:32.660
We can also get details on the layer to information with a get l two VPN space

168
08:32.660 --> 08:36.660
question mark and let's go ahead and type in sessions and a space in the

169
08:36.660 --> 08:40.780
question mark and let's go ahead and look at stats as well while we're there

170
08:40.780 --> 08:41.800
and press enter.

171
08:41.800 --> 08:46.620
Another showing us the statistics regarding the l two VPN and currently we have

172
08:46.620 --> 08:51.270
absolutely no packets in or out and that's because we're not sending traffic

173
08:51.270 --> 08:53.000
over that l two VPN yet.

174
08:53.000 --> 08:57.400
So if we're to use a pipe symbol after that and say find and then include the

175
08:57.400 --> 09:02.550
word packets, then it just shows output that include that literal string of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

175
08:57.400 --> 09:02.550
word packets, then it just shows output that include that literal string of

176
09:02.550 --> 09:04.600
text with capital P a C K E T S.

177
09:04.600 --> 09:08.960
So if we come back into this after we've implemented a common network segment

178
09:08.960 --> 09:13.950
and associate with the later to VPN, we should see the packet counts in and out

179
09:13.950 --> 09:17.700
increasing, which leads us to the next piece of the puzzle and that is to go

180
09:17.700 --> 09:19.100
ahead and create

181
09:19.100 --> 09:24.100
a common segment at both locations and associate that with the l two VPNs.

182
09:24.100 --> 09:27.040
So currently we have a few segments that are currently in place, but let's

183
09:27.040 --> 09:32.000
create a brand new segment at site three where the server is and also here at
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

183
09:27.040 --> 09:32.000
create a brand new segment at site three where the server is and also here at

184
09:32.000 --> 09:34.100
site four where this client is.

185
09:34.100 --> 09:38.710
And then we'll go ahead and take the segments and associate those with the l

186
09:38.710 --> 09:43.680
two VPN to create one large layer to broadcast domain and associate subnet that

187
09:43.680 --> 09:45.600
we can then connect VMS to.

188
09:45.600 --> 09:49.660
So we'll proceed with the creation of those two segments and linking them to

189
09:49.660 --> 09:51.700
the layer to VPN in the next video.

190
09:51.700 --> 09:53.700
So I'll see you there in just a moment.

191
09:53.700 --> 10:03.700
[BLANK_AUDIO]