WEBVTT

1
00:00.000 --> 00:04.080
So to actually take advantage and use the layer 2vpn's, we need to make sure we

2
00:04.080 --> 00:05.040
have segments

3
00:05.040 --> 00:10.040
at each of the sites and associate those segments with that ltvpn. So here's

4
00:10.040 --> 00:11.200
what I propose we do.

5
00:11.200 --> 00:15.200
At the site where the server is, let's create a brand new overlay segment and

6
00:15.200 --> 00:15.680
let's go ahead and

7
00:15.680 --> 00:24.640
call it s3 for site 3 ltvpn segment 99 and then over here at site 4, let's

8
00:24.640 --> 00:25.520
create a segment called

9
00:25.520 --> 00:32.990
s4 for site 4 and let's also name that l2vpn and s3 99. And then when we have
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:25.520 --> 00:32.990
s4 for site 4 and let's also name that l2vpn and s3 99. And then when we have

10
00:32.990 --> 00:33.520
those segments

11
00:33.520 --> 00:38.470
created, we're then going to associate them with our layer 2vpn. And when we do

12
00:38.470 --> 00:39.280
that, that's the

13
00:39.280 --> 00:44.320
magic that logically creates one giant layer 2 broadcast domain. And then this

14
00:44.320 --> 00:45.280
traffic goes back

15
00:45.280 --> 00:50.130
and forth between clients on those respective segments, that traffic is sent

16
00:50.130 --> 00:51.120
via ipsec between

17
00:51.120 --> 00:55.500
the endpoints. And let's also take a moment and identify the flow of traffic

18
00:55.500 --> 00:57.360
between those vm. So

19
00:57.360 --> 01:00.530
over here on the left, so over here, let me go ahead and just for the purpose
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

19
00:57.360 --> 01:00.530
over here on the left, so over here, let me go ahead and just for the purpose

20
01:00.530 --> 01:01.440
of this exercise,

21
01:01.440 --> 01:07.150
let's call this site 3vm for right there. And for this one, we'll call it site

22
01:07.150 --> 01:09.600
4vm right there.

23
01:09.600 --> 01:14.560
And so if we are going to predict the traffic flow between this vm at site 3

24
01:14.560 --> 01:15.760
and this vm at site 4,

25
01:15.760 --> 01:20.740
once all the configuration is done, let's start over here with site 3vm. So the

26
01:20.740 --> 01:21.760
initial processing

27
01:21.760 --> 01:25.640
is going to be done by whatever host that VM is on. And then that traffic is

28
01:25.640 --> 01:26.400
going to be sent

29
01:26.400 --> 01:31.870
to a local edge node. And all of this up to this point would be at site 3. And
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
01:26.400 --> 01:31.870
to a local edge node. And all of this up to this point would be at site 3. And

30
01:31.870 --> 01:32.240
then one of our

31
01:32.240 --> 01:36.400
edge nodes at site 3 would be sending the traffic over to another edge over

32
01:36.400 --> 01:37.520
here at site 4. So over

33
01:37.520 --> 01:42.280
here at site 4, we'd have one of the active local edges here. Let me also label

34
01:42.280 --> 01:44.160
this as site 4. And

35
01:44.160 --> 01:47.610
the local edge would do some processing and then hand it off to the appropriate

36
01:47.610 --> 01:49.280
host over at site 4,

37
01:49.280 --> 01:53.440
who would then deliver it to the VM. And right here between these two edge

38
01:53.440 --> 01:53.680
nodes,

39
01:53.680 --> 01:57.900
the edge over here at site 3 and the edge at site 4, this would be an IPsec

40
01:57.900 --> 01:58.560
tunnel that's

41
01:58.560 --> 02:02.000
protecting the traffic. So from anybody eavesdropping on the traffic here on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:58.560 --> 02:02.000
protecting the traffic. So from anybody eavesdropping on the traffic here on

42
02:02.000 --> 02:02.960
the internet or on this

43
02:02.960 --> 02:06.390
public segment, all they would see is traffic that's being sent to receive

44
02:06.390 --> 02:07.440
between these two

45
02:07.440 --> 02:11.300
addresses, the two ends of the tunnel. And as far as the payload is concerned,

46
02:11.300 --> 02:11.840
no matter what

47
02:11.840 --> 02:15.060
traffic was being sent back and forth between these VMs, that traffic would all

48
02:15.060 --> 02:15.920
just look like

49
02:15.920 --> 02:19.880
ESP traffic encapsulated and encrypted traffic, the courtesy of IPsec to

50
02:19.880 --> 02:21.200
protect the contents of

51
02:21.200 --> 02:24.710
what's really happening in those packets. So with that in mind, let's create

52
02:24.710 --> 02:26.080
our new segments here

53
02:26.080 --> 02:31.510
at site 3 and at site 4. We'll associate each of them with the layer 2 VPN. We
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
02:26.080 --> 02:31.510
at site 3 and at site 4. We'll associate each of them with the layer 2 VPN. We

54
02:31.510 --> 02:32.400
'll put a couple of VMs

55
02:32.400 --> 02:36.870
on there and then verify that it's working. So let's begin here at site 3. We

56
02:36.870 --> 02:37.760
'll go to the

57
02:37.760 --> 02:41.520
networking tab. And currently, I have an overlay segment here at site 3 called

58
02:41.520 --> 02:43.040
site 3 subnet 33.

59
02:43.040 --> 02:46.200
And what we're going to do is simply create a new one. So we'll click here on

60
02:46.200 --> 02:46.880
add segment.

61
02:46.880 --> 02:54.000
Based on our plan, let's call this S3 L2 VPN space SEG 99. And then we'll

62
02:54.000 --> 02:55.200
connect that to our

63
02:55.200 --> 02:59.230
tier 0 gateway. We could also just as well connect that to a tier 1 gateway. If

64
02:59.230 --> 03:00.000
we had one in our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
03:00.000 --> 03:04.060
topology, then we'll select an overlay transport zone. So we'll go ahead and

66
03:04.060 --> 03:05.440
choose our red overlay

67
03:05.440 --> 03:08.880
transport zone. Let me go ahead and also collapse the left hand side to give us

68
03:08.880 --> 03:09.600
a little bit more

69
03:09.600 --> 03:13.970
room right here. And then let's also specify a default gateway address that

70
03:13.970 --> 03:14.720
clients on that

71
03:14.720 --> 03:20.650
network can use. Let's go and use 10 dot 99 dot 0 dot 1 with a 24 bit mask,

72
03:20.650 --> 03:21.840
just like that. Also,

73
03:21.840 --> 03:26.800
while we're here, let's enable DHCP services. We'll click here on set DHCP. And

74
03:26.800 --> 03:27.200
let's go ahead

75
03:27.200 --> 03:31.480
and use a gateway based DHCP server. And we already have a DHCP profile
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
03:27.200 --> 03:31.480
and use a gateway based DHCP server. And we already have a DHCP profile

76
03:31.480 --> 03:32.800
associated with our

77
03:32.800 --> 03:36.800
gateway. So it's going to use that DHCP profile. And then for the range, let's

78
03:36.800 --> 03:37.520
go ahead and put

79
03:37.520 --> 03:43.540
in 10 dot 99 dot 0 dot 31 all the way through 10 dot 99 dot 0 dot 39. Now I

80
03:43.540 --> 03:44.800
know that's not very

81
03:44.800 --> 03:47.710
many. However, I want to be able to confirm when we get a nice address on a

82
03:47.710 --> 03:48.720
client where it came

83
03:48.720 --> 03:53.680
from. So we could on each of our sites have local DHCP services, or we can just

84
03:53.680 --> 03:54.640
have one

85
03:54.640 --> 03:59.080
global set of DHCP services that we're using from one of our sites. So in this

86
03:59.080 --> 03:59.600
case, I'm

87
03:59.600 --> 04:04.240
configuring this pool of addresses right here at the server at site three. And
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
03:59.600 --> 04:04.240
configuring this pool of addresses right here at the server at site three. And

88
04:04.240 --> 04:04.800
I'm going to set a

89
04:04.800 --> 04:09.080
pretty low lease time of like say 1000 seconds. And also a DNS server of eight

90
04:09.080 --> 04:09.760
dot eight to date

91
04:09.760 --> 04:14.580
to date. And we'll click on apply. All right, so now DHCP services are set up.

92
04:14.580 --> 04:15.520
Now what's not yet

93
04:15.520 --> 04:21.010
done is this part right here layer two VPN. So right here we can also just

94
04:21.010 --> 04:22.960
associate this segment

95
04:22.960 --> 04:26.240
with that layer two VPN service. But I want to create the two segments first,

96
04:26.240 --> 04:29.680
and then I'll come back and I'll walk you through linking it up. So we'll go

97
04:29.680 --> 04:30.400
ahead and simply click
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
04:29.680 --> 04:30.400
ahead and simply click

98
04:30.400 --> 04:35.440
on save and click on now. So there is our segment right there. And let's create

99
04:35.440 --> 04:36.400
a similar segment

100
04:36.400 --> 04:40.550
over at site four. So over here at site four, we'll go to networking on the

101
04:40.550 --> 04:41.680
left. We'll click on

102
04:41.680 --> 04:45.940
segments here is our current segments. And let's create a new one here as well

103
04:45.940 --> 04:47.200
over at site four.

104
04:47.200 --> 04:51.950
So we'll click on add segment. Let's give it the name of S four for site four l

105
04:51.950 --> 04:52.320
tvpn

106
04:52.320 --> 04:56.300
segment 99. So the actual name of the segment at each of the sites doesn't

107
04:56.300 --> 04:57.680
really matter too much

108
04:57.680 --> 05:02.270
is the linking that segment over to the ltvpn service that does the magic of gl
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
04:57.680 --> 05:02.270
is the linking that segment over to the ltvpn service that does the magic of gl

109
05:02.270 --> 05:03.440
uing it all together.

110
05:03.440 --> 05:07.200
So here at site four for this new segment, we'll associate it with our T zero

111
05:07.200 --> 05:08.000
gateway.

112
05:08.000 --> 05:12.250
We'll also associate it with our transport zone here at site four. And I'm also

113
05:12.250 --> 05:12.800
going to use the

114
05:12.800 --> 05:18.640
same default gateway address of 10 dot 99 dot zero dot one with a 24 bit mask.

115
05:18.640 --> 05:19.200
And let's also set

116
05:19.200 --> 05:23.160
up DHCP services here for the segment over at site four. So I'll click here, I

117
05:23.160 --> 05:24.720
set DHCP config.

118
05:24.720 --> 05:29.760
And we'll set it up as a gateway DHCP server. And for the range here, let's use

119
05:29.760 --> 05:31.360
10 dot 99 dot zero
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
05:29.760 --> 05:31.360
10 dot 99 dot zero

120
05:31.360 --> 05:38.540
dot. And let's use 41 through 10 dot 99 dot zero dot 49. And that way we can

121
05:38.540 --> 05:39.520
see exactly who got

122
05:39.520 --> 05:43.430
what IP addresses and from where so at site three, I'm handing out 31 through

123
05:43.430 --> 05:44.720
39. And here at site

124
05:44.720 --> 05:49.710
four, we're handing out 41 through 49. Or we could just leave off DHCP services

125
05:49.710 --> 05:50.800
here. And once we

126
05:50.800 --> 05:54.980
have the layer two VPNs all set up, a client at site four could get an IP

127
05:54.980 --> 05:56.560
address from the DHCP

128
05:56.560 --> 06:00.500
service over at site three, because at the end of the day, they'll look and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

128
05:56.560 --> 06:00.500
service over at site three, because at the end of the day, they'll look and

129
06:00.500 --> 06:01.920
feel like they're on one

130
06:01.920 --> 06:06.050
logical layer two broadcast domain. And so DHCP services at site three would

131
06:06.050 --> 06:07.040
support the clients

132
06:07.040 --> 06:10.330
over at site four. So here, I'm also going to set it fairly low lease and I say

133
06:10.330 --> 06:11.360
1000 seconds.

134
06:11.360 --> 06:15.680
And for DNS, I'll point out to Google DNS server, just like that. And we'll

135
06:15.680 --> 06:16.960
click on apply. Also,

136
06:16.960 --> 06:21.260
once again, here, we could go to the L2 VPN settings and identify the L2 VPN

137
06:21.260 --> 06:22.400
that we want to join. But

138
06:22.400 --> 06:26.350
before we do that, this will verify basic connectivity. So we'll click on save

139
06:26.350 --> 06:28.080
and click on no. And now

140
06:28.080 --> 06:33.680
that we have these two new segments, one here at site four, and the other one
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

140
06:28.080 --> 06:33.680
that we have these two new segments, one here at site four, and the other one

141
06:33.680 --> 06:35.200
over at site three,

142
06:35.200 --> 06:39.680
I would like to put a couple VMs on those segments and just verify that locally

143
06:39.680 --> 06:40.240
, they can get out

144
06:40.240 --> 06:44.060
to the internet. Now at site three, I already have not set up and there's

145
06:44.060 --> 06:44.960
external access.

146
06:44.960 --> 06:48.740
And at site four, else I've not set up an external access. So it's what I

147
06:48.740 --> 06:50.080
verify with these two VMs

148
06:50.080 --> 06:54.350
before we include both of them as part of our layer two VPN. That's what I

149
06:54.350 --> 06:55.440
verify we have basic

150
06:55.440 --> 06:59.860
functionality at both sites. So to do that at site three, let's go to the v

151
06:59.860 --> 07:01.280
Sphere client and put
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

151
06:59.860 --> 07:01.280
Sphere client and put

152
07:01.280 --> 07:05.590
this VM on the segment and verify that we can get out to the internet. So here

153
07:05.590 --> 07:06.480
in light mode,

154
07:06.480 --> 07:11.600
on the vSphere client at site three, let's go to the networking tab. And let's

155
07:11.600 --> 07:12.160
currently see

156
07:12.160 --> 07:17.420
what we have out there. So on site three subnet 33, I've got a couple VMs. Let

157
07:17.420 --> 07:18.880
's go ahead and use

158
07:18.880 --> 07:23.910
this site three red VM. I'm going to right click on the NSX segment here and

159
07:23.910 --> 07:25.200
say let's migrate VMs

160
07:25.200 --> 07:29.080
to another network. And let's target the new one we just made, which is our

161
07:29.080 --> 07:30.560
site three L2 VPN
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

161
07:29.080 --> 07:30.560
site three L2 VPN

162
07:30.560 --> 07:35.330
segment 99. Click on next. And let's just move this one specific VM over there,

163
07:35.330 --> 07:36.640
site three red VM

164
07:36.640 --> 07:41.280
right there and click on next and finish fantastic. So it should disappear from

165
07:41.280 --> 07:42.960
this list. And when it

166
07:42.960 --> 07:49.140
does fantastic, we'll go over to segment L2 VPN, seg 99. And we'll confirm our

167
07:49.140 --> 07:50.240
VM is there. Sure

168
07:50.240 --> 07:53.760
enough. So we'll go ahead and click on our VM. We'll power it on by clicking on

169
07:53.760 --> 07:55.520
the icon for power on.

170
07:55.520 --> 08:01.440
And let's also open up a remote console to the site three red VM by clicking
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

170
07:55.520 --> 08:01.440
And let's also open up a remote console to the site three red VM by clicking

171
08:01.440 --> 08:02.880
right here. So here

172
08:02.880 --> 08:07.930
is the window for that little teeny VM. Let me make that a little bit bigger.

173
08:07.930 --> 08:08.640
Fantastic. And

174
08:08.640 --> 08:12.820
let's do an IF config for ethernet zero just to confirm its IP address. So it

175
08:12.820 --> 08:13.760
got the IP address

176
08:13.760 --> 08:18.660
ending in 31. Let's also confirm it has a default gateway with the route space

177
08:18.660 --> 08:20.000
dash N. And it has

178
08:20.000 --> 08:24.240
a default gateway of 1099 01. And as I mentioned, I already have not set up out

179
08:24.240 --> 08:25.200
to the public internet.

180
08:25.200 --> 08:30.140
So let's do a trace. I'll do a dash N for don't bother doing name resolution.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

180
08:25.200 --> 08:30.140
So let's do a trace. I'll do a dash N for don't bother doing name resolution.

181
08:30.140 --> 08:31.360
And we'll do a dash M

182
08:31.360 --> 08:35.360
six for the maximum number of hops to be six just to verify the initial several

183
08:35.360 --> 08:35.760
hops out

184
08:35.760 --> 08:40.040
towards the internet. And let's also verify name resolution at the same time by

185
08:40.040 --> 08:40.560
trying to go to

186
08:40.560 --> 08:46.700
www.vmware.com and press enter. And sure enough, that looks great. So it's

187
08:46.700 --> 08:47.760
going out to the internet.

188
08:47.760 --> 08:53.390
DNS is working fantastic. Let's also do the same verification over at site for

189
08:53.390 --> 08:54.560
so over at site for

190
08:54.560 --> 08:58.440
which is in dark mode, we'll go ahead and make sure we have a VM on that

191
08:58.440 --> 08:59.680
correct segment. And

192
08:59.680 --> 09:02.790
then verify we can get up to the internet from that one as well. All right. So
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

192
08:59.680 --> 09:02.790
then verify we can get up to the internet from that one as well. All right. So

193
09:02.790 --> 09:03.600
here we are in the

194
09:03.600 --> 09:08.980
vSphere client at site for let's go to the networking tab. And I've got site

195
09:08.980 --> 09:11.120
for segment 44. And let's

196
09:11.120 --> 09:14.720
go ahead and use this little VM right here site for violet VM. So I'm going to

197
09:14.720 --> 09:15.600
right click on that

198
09:15.600 --> 09:19.840
network segment from the drop down, say migrate VMS to another segment. And the

199
09:19.840 --> 09:20.880
target is going to be

200
09:20.880 --> 09:26.020
our S for L to VPN segment 99. We'll click on next. And then we'll choose just

201
09:26.020 --> 09:27.440
that one VM site for

202
09:27.440 --> 09:31.490
violet VM. And then click on next a couple times and finish. And that should
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

202
09:27.440 --> 09:31.490
violet VM. And then click on next a couple times and finish. And that should

203
09:31.490 --> 09:32.480
disappear from this

204
09:32.480 --> 09:36.670
list. There it goes. And now if we go over to that new segment, there it is

205
09:36.670 --> 09:37.760
right there. So we'll go

206
09:37.760 --> 09:42.450
ahead and click on it. We'll power it on. And let's open up a remote console to

207
09:42.450 --> 09:43.680
that one as well.

208
09:43.680 --> 09:48.520
So here is that VM. Let me go ahead and make that a little bit bigger for us.

209
09:48.520 --> 09:49.040
And let's do an

210
09:49.040 --> 09:53.660
IF config. So we've got an IP address from its local DHCP services on the local

211
09:53.660 --> 09:54.560
segment. And

212
09:54.560 --> 10:00.270
let's also verify that it has a default gateway with route space dash and press
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

212
09:54.560 --> 10:00.270
let's also verify that it has a default gateway with route space dash and press

213
10:00.270 --> 10:01.040
enter. So it's

214
10:01.040 --> 10:06.170
default gateways 1099 01 here at site four. And let's do a trace route with no

215
10:06.170 --> 10:07.920
name resolution needed.

216
10:07.920 --> 10:14.950
And a maximum number of hops, let's say seven out to www.vmware.com. And that

217
10:14.950 --> 10:15.920
'll verify name

218
10:15.920 --> 10:19.840
resolution. It'll verify internet connectivity. And also based on a second hop,

219
10:19.840 --> 10:20.320
it's going out

220
10:20.320 --> 10:24.500
through our service provider at 24 dot 1 dot 2 dot 1. So now that we've

221
10:24.500 --> 10:25.680
verified that these two

222
10:25.680 --> 10:31.360
VMs can get up to the internet, let's now merge effectively these two segments.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

222
10:25.680 --> 10:31.360
VMs can get up to the internet, let's now merge effectively these two segments.

223
10:31.360 --> 10:31.840
This one here at

224
10:31.840 --> 10:35.490
site three along with this one site four. And to do that, we're simply going to

225
10:35.490 --> 10:36.080
associate

226
10:36.080 --> 10:40.640
those local segments with the LTVPN. Now, as part of that, they're going to ask

227
10:40.640 --> 10:42.160
us for a segment number.

228
10:42.160 --> 10:47.190
Let's just use a segment number of 99. And then once we associate this segment

229
10:47.190 --> 10:47.520
with our layer

230
10:47.520 --> 10:53.320
to VPN and this segment with our layer to VPN, effectively, these two segments

231
10:53.320 --> 10:54.800
appear as one

232
10:54.800 --> 10:58.790
giant layer to broadcast domains. And these two VMs should be able to reach

233
10:58.790 --> 10:59.920
each other. And as they

234
10:59.920 --> 11:03.800
do so, that traffic, as it goes between the edges at the respective sites, will
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

234
10:59.920 --> 11:03.800
do so, that traffic, as it goes between the edges at the respective sites, will

235
11:03.800 --> 11:04.480
be encrypted and

236
11:04.480 --> 11:08.940
protected via IPsec. Also in preparation for this, let's just verify that they

237
11:08.940 --> 11:09.760
can't currently

238
11:09.760 --> 11:14.910
ping each other. So from the left VM, that's the site three red VM, let's do a

239
11:14.910 --> 11:16.880
ping over to 10 dot

240
11:16.880 --> 11:22.930
99 dot 0 dot 41, which is the IP address over at site four. And then from site

241
11:22.930 --> 11:23.920
four VM, let's go

242
11:23.920 --> 11:29.510
into a ping to 10 dot 99 dot 0 dot 31, which is the IP address of the site

243
11:29.510 --> 11:31.120
three VM. So at the moment,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

243
11:29.510 --> 11:31.120
three VM. So at the moment,

244
11:31.120 --> 11:33.750
none of that traffic should be making it because we don't have those two

245
11:33.750 --> 11:34.800
segments where those two

246
11:34.800 --> 11:38.760
VMs are those are not currently associated with the layer to VPN. But once we

247
11:38.760 --> 11:40.080
make that association,

248
11:40.080 --> 11:43.910
then that traffic should be forwarded between site three and site four

249
11:43.910 --> 11:44.880
respectively.

250
11:44.880 --> 11:49.440
So here at the NSX manager for site three, we're going to click on networking.

251
11:49.440 --> 11:50.000
And there's actually

252
11:50.000 --> 11:54.690
two different ways of linking a segment with an L2 VPN. And I'm going to

253
11:54.690 --> 11:56.000
demonstrate both for you.

254
11:56.000 --> 12:00.370
So here at site three, the first option we have is we could actually go down to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

254
11:56.000 --> 12:00.370
So here at site three, the first option we have is we could actually go down to

255
12:00.370 --> 12:00.800
the network

256
12:00.800 --> 12:04.830
segment. So we'll click on networking, we'll go to segments. And then we'll

257
12:04.830 --> 12:05.520
find the segment that

258
12:05.520 --> 12:08.870
we want to associate with the layer to VPN, which in our case, at site three,

259
12:08.870 --> 12:09.760
it's this one right

260
12:09.760 --> 12:15.190
here, the S3 L2 VPN, SEG 99 segment. And what we'll simply do is we'll simply

261
12:15.190 --> 12:16.320
edit it by clicking on

262
12:16.320 --> 12:21.200
the three dots, clicking on edit, and then scrolling down, and then expanding

263
12:21.200 --> 12:22.960
the L2 VPN section for

264
12:22.960 --> 12:27.810
that segment. And from here, we just associate it with our layer to VPN. So to

265
12:27.810 --> 12:28.880
do that, we'll click

266
12:28.880 --> 12:33.440
here in this box is showing us a dropdown of all the L2 VPN services available.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

266
12:28.880 --> 12:33.440
here in this box is showing us a dropdown of all the L2 VPN services available.

267
12:33.440 --> 12:34.240
So we have the

268
12:34.240 --> 12:38.720
site three L2 VPN servers, we'll select that next is asking us for a tunnel ID

269
12:38.720 --> 12:39.360
that can be between

270
12:39.360 --> 12:44.640
one and 4096. So let's use a tunnel ID of 99. And then we also have an option

271
12:44.640 --> 12:45.200
of setting up a

272
12:45.200 --> 12:49.550
local egress gateway IP. So because we already have one at each of the sites,

273
12:49.550 --> 12:50.240
we don't also need

274
12:50.240 --> 12:54.530
to include one here. So all we've really done is specify the layer to VPN, and

275
12:54.530 --> 12:56.240
a VPN tunnel ID

276
12:56.240 --> 12:59.450
for that segment. And we'll click on save, and then we'll scroll down and click

277
12:59.450 --> 13:00.720
on close editing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

277
12:59.450 --> 13:00.720
on close editing.

278
13:00.720 --> 13:05.810
And so now if we went back to our network services and to VPN, and we went to

279
13:05.810 --> 13:07.760
our L2 VPN sessions,

280
13:07.760 --> 13:11.990
check it out here for this L2 VPN session that we have between site three and

281
13:11.990 --> 13:12.800
site four,

282
13:12.800 --> 13:18.070
it now shows that there's one segment associated with that L2 VPN session. If

283
13:18.070 --> 13:18.880
we click on that

284
13:18.880 --> 13:23.620
hyperlink there for that one is showing us the exact L2 VPN segment, including

285
13:23.620 --> 13:24.400
the VPN tunnel

286
13:24.400 --> 13:29.410
ID associated with it. So here at site three, we've associated our segment,

287
13:29.410 --> 13:30.720
which is right here,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

287
13:29.410 --> 13:30.720
which is right here,

288
13:30.720 --> 13:35.920
we've associated it with our L2 VPN. So now all we need to do is do the similar

289
13:35.920 --> 13:36.880
treatment over

290
13:36.880 --> 13:40.720
at site four. So here at site four, we'll click on networking. And once again,

291
13:40.720 --> 13:41.520
we could go to our

292
13:41.520 --> 13:46.000
segments and then go edit the details for this segment right here and associate

293
13:46.000 --> 13:46.720
with our layer

294
13:46.720 --> 13:52.460
to VPN, or we could go to our VPN section here under network services. And then

295
13:52.460 --> 13:53.040
we could click on

296
13:53.040 --> 13:57.670
our L2 VPN sessions right here. So currently for this L2 VPN session, we have

297
13:57.670 --> 13:58.480
zero segments

298
13:58.480 --> 14:03.180
associated, but we could click on the three dots, click on edit to edit our L2
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

298
13:58.480 --> 14:03.180
associated, but we could click on the three dots, click on edit to edit our L2

299
14:03.180 --> 14:04.320
VPN session. And then

300
14:04.320 --> 14:08.040
here for the segments, we could click on set, which once again gives the

301
14:08.040 --> 14:09.680
opportunity to associate

302
14:09.680 --> 14:13.440
the segment that we want to include as part of the L2 VPN. So here at site four

303
14:13.440 --> 14:14.560
, we'll click on add

304
14:14.560 --> 14:17.660
segment from the dropdown, we'll choose the correct segment, which is this one

305
14:17.660 --> 14:18.160
right here,

306
14:18.160 --> 14:23.490
S four L2 VPN, S. 99. We'll specify the tunnel ID of 99. Once again, we have

307
14:23.490 --> 14:24.240
the option of setting

308
14:24.240 --> 14:28.460
up a local egress for outbound gateway IP address to use. We already have that

309
14:28.460 --> 14:29.280
set up as part of the

310
14:29.280 --> 14:32.790
segment. So I'm going to go ahead and click on save and click on close. And
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

310
14:29.280 --> 14:32.790
segment. So I'm going to go ahead and click on save and click on close. And

311
14:32.790 --> 14:33.840
then we'll click on

312
14:33.840 --> 14:37.490
close editing. And notice now that we have a one here representing that we have

313
14:37.490 --> 14:38.000
a segment

314
14:38.000 --> 14:41.690
associated with our layer to VPN, we can also crash reference and confirm that

315
14:41.690 --> 14:43.280
by going to segments,

316
14:43.280 --> 14:48.960
expanding our S four L2 VPN, S. 99, expand the L2 section right here. And it's

317
14:48.960 --> 14:49.440
going to have those

318
14:49.440 --> 14:52.480
same details right here, because we can figure those at the segment.