WEBVTT

1
00:00.240 --> 00:02.550
So let's put a game plan together

2
00:02.550 --> 00:07.230
for the addition of ESXi-A and ESXi-B

3
00:07.230 --> 00:10.380
as host transport nodes in NSX.

4
00:10.380 --> 00:11.820
So we've identified the two hosts

5
00:11.820 --> 00:15.390
that we're going to include, ESXi-A and ESXi-B.

6
00:15.390 --> 00:17.940
We're gonna make them host transport nodes.

7
00:17.940 --> 00:20.070
And in addition to knowing which ESXi host

8
00:20.070 --> 00:22.410
we want to include as transport nodes,

9
00:22.410 --> 00:24.840
let's also identify which uplinks we want

10
00:24.840 --> 00:28.500
those ESXi hosts to use as part of NSX.

11
00:28.500 --> 00:31.230
And currently I have a few unused physical uplinks.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:28.500 --> 00:31.230
And currently I have a few unused physical uplinks.

12
00:31.230 --> 00:34.020
The VMNICs on the actual ESXi host,

13
00:34.020 --> 00:37.980
including VMNIC2 right here and three right there.

14
00:37.980 --> 00:40.470
So those are both available to be used as uplinks.

15
00:40.470 --> 00:45.090
And I propose we use those as uplinks as part of NSX.

16
00:45.090 --> 00:46.440
And this red horizontal line here

17
00:46.440 --> 00:47.880
represents the transport network.

18
00:47.880 --> 00:50.940
So between ESXi-A and ESXi-B,

19
00:50.940 --> 00:53.580
we could have routers and additional switches

20
00:53.580 --> 00:55.620
that are able to forward traffic back and forth,

21
00:55.620 --> 00:57.030
but it doesn't necessarily mean

22
00:57.030 --> 00:59.460
that they're in the same layer two broadcast domain.

23
00:59.460 --> 01:00.540
So on the physical network,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:59.460 --> 01:00.540
So on the physical network,

24
01:00.540 --> 01:03.660
I've got the ports connected to VMNIC2 and three

25
01:03.660 --> 01:05.430
on both of these ESXi hosts.

26
01:05.430 --> 01:06.870
They are configured as trunks.

27
01:06.870 --> 01:10.050
And the transport network represents routers and switches.

28
01:10.050 --> 01:12.030
They're able to forward packets back and forth

29
01:12.030 --> 01:14.400
between ESXi-A and ESXi-B.

30
01:14.400 --> 01:17.310
So although it could be a single layer two VLAN,

31
01:17.310 --> 01:18.570
it doesn't have to be.

32
01:18.570 --> 01:19.617
As long as we have IP routing

33
01:19.617 --> 01:22.470
and reachability between the two ESXi hosts,

34
01:22.470 --> 01:23.490
that's all that's needed.

35
01:23.490 --> 01:25.830
So for our game plans, here's what I propose we do.

36
01:25.830 --> 01:29.580
Let's use a single uplink as the primary uplink,

37
01:29.580 --> 01:32.310
and that'll be VMNIC2 as the active uplink,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:29.580 --> 01:32.310
and that'll be VMNIC2 as the active uplink,

38
01:32.310 --> 01:35.340
both ESXi hosts that are acting as transport nodes.

39
01:35.340 --> 01:38.940
And we'll set up VMNIC3 as passive as a backup.

40
01:38.940 --> 01:40.650
So we'll set that up on both of these,

41
01:40.650 --> 01:43.950
what are gonna be transport nodes, ESXi-A and ESXi-B.

42
01:43.950 --> 01:45.420
Now, as part of the configuration

43
01:45.420 --> 01:47.640
to specify which uplinks we're gonna use,

44
01:47.640 --> 01:49.500
we're gonna create an uplink profile.

45
01:49.500 --> 01:51.510
And as part of that, we're also gonna specify

46
01:51.510 --> 01:53.610
which VLANs we wanna use.

47
01:53.610 --> 01:56.490
Now, because my infrastructure supports trunking here,

48
01:56.490 --> 01:58.230
and I have routing capabilities

49
01:58.230 --> 02:00.210
between these two ESXi hosts,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
01:58.230 --> 02:00.210
between these two ESXi hosts,

50
02:00.210 --> 02:02.400
for the benefit of education,

51
02:02.400 --> 02:05.130
I would like to use two different VLANs,

52
02:05.130 --> 02:08.250
one on ESXi-A, and one on ESXi-B.

53
02:08.250 --> 02:10.050
And that way from a learning perspective,

54
02:10.050 --> 02:13.230
when we see the IP addresses and the subnets involved,

55
02:13.230 --> 02:15.720
it'll be very clear about which ESXi host

56
02:15.720 --> 02:18.270
is at which end of the Geneve tunnel.

57
02:18.270 --> 02:20.730
So for our game plan, for ESXi-A,

58
02:20.730 --> 02:22.620
let's use for the transport network,

59
02:22.620 --> 02:25.740
let's go ahead and use VLAN 101.

60
02:25.740 --> 02:29.670
And for ESXi-B, let's use VLAN 102.

61
02:29.670 --> 02:32.580
And then associated with that in the VLAN 101,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:29.670 --> 02:32.580
And then associated with that in the VLAN 101,

62
02:32.580 --> 02:36.150
I'm using the IP address base of 10.11.11.

63
02:36.150 --> 02:41.150
And on the VLAN 102, I'm using the address base of 10.22.22.

64
02:41.160 --> 02:42.540
And everything we implement here is gonna be

65
02:42.540 --> 02:44.970
with a slash 24, 24 bit mask.

66
02:44.970 --> 02:46.560
So visually, what this will look like

67
02:46.560 --> 02:49.140
when they start building their tunnels between each other,

68
02:49.140 --> 02:50.370
we're gonna have this logical tunnel,

69
02:50.370 --> 02:54.090
this Geneve tunnel between ESXi-A and ESXi-B.

70
02:54.090 --> 02:55.200
And at this end of the tunnel,

71
02:55.200 --> 02:57.780
which is called a tunnel endpoint, or TEP for short,

72
02:57.780 --> 03:01.470
they'll be using address base of 10.11.11.something.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
02:57.780 --> 03:01.470
they'll be using address base of 10.11.11.something.

73
03:01.470 --> 03:04.410
In fact, we can hard code it as well, like .11.

74
03:04.410 --> 03:08.340
And then over here at ESXi-B is tunnel endpoint address.

75
03:08.340 --> 03:09.360
It'll be in VLAN 102.

76
03:09.360 --> 03:12.237
So we can go ahead and use something like 10.22.22,

77
03:12.237 --> 03:15.570
and just for simplicity, we can just hard code it as 22

78
03:15.570 --> 03:16.710
for the host address.

79
03:16.710 --> 03:20.460
And then later on we create a segment in the world of NSX,

80
03:20.460 --> 03:22.140
specifically an overlay segment,

81
03:22.140 --> 03:23.640
and we connect a couple of VMs to it,

82
03:23.640 --> 03:27.090
for example, connect this VM to it and this VM to it.

83
03:27.090 --> 03:29.130
So because they're in this common overlay segment,

84
03:29.130 --> 03:32.820
it looks to the VMs, it just looks like a common giant
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
03:29.130 --> 03:32.820
it looks to the VMs, it just looks like a common giant

85
03:32.820 --> 03:34.110
layer two broadcast domain.

86
03:34.110 --> 03:36.330
So this VM could be at 10.10.0.10,

87
03:36.330 --> 03:39.510
and over here this VM could be at 10.10.0.11.

88
03:39.510 --> 03:41.820
And logically they would be on the same

89
03:41.820 --> 03:44.340
layer two broadcast domain with IP addresses

90
03:44.340 --> 03:45.900
and the same IP subnet.

91
03:45.900 --> 03:46.770
But behind the scenes,

92
03:46.770 --> 03:48.540
when that traffic needs to go back and forth

93
03:48.540 --> 03:51.720
between this VM, we'll call it VM-A,

94
03:51.720 --> 03:53.820
and this VM, we'll call it VM-B,

95
03:53.820 --> 03:57.030
that traffic is actually gonna be received by the ESXi host.

96
03:57.030 --> 04:00.030
It'll be encapsulated inside of the Geneve tunnel,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
03:57.030 --> 04:00.030
It'll be encapsulated inside of the Geneve tunnel,

97
04:00.030 --> 04:02.610
sent over to the pier who will deencapsulate it,

98
04:02.610 --> 04:05.070
and then forwarded on to the final destination.

99
04:05.070 --> 04:06.960
And by using separate VLANs here

100
04:06.960 --> 04:09.600
and separate IP addressing spaces respectively,

101
04:09.600 --> 04:11.490
it'll be a lot easier from a learning perspective

102
04:11.490 --> 04:13.830
for you to see exactly the IP address

103
04:13.830 --> 04:16.140
being significantly different in different subnets.

104
04:16.140 --> 04:18.840
It also makes it super easy to identify the source

105
04:18.840 --> 04:20.220
and destination of the tunnel

106
04:20.220 --> 04:22.680
based on the significantly different IP address.

107
04:22.680 --> 04:24.870
And when we do create NSX overlay segments,

108
04:24.870 --> 04:26.490
like this one right here in yellow,

109
04:26.490 --> 04:29.010
those are gonna be associated with a transport zone.

110
04:29.010 --> 04:30.960
And a transport zone simply controls
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
04:29.010 --> 04:30.960
And a transport zone simply controls

111
04:30.960 --> 04:33.210
how far a segment is gonna go.

112
04:33.210 --> 04:34.590
And as a quick reminder of that,

113
04:34.590 --> 04:36.300
if we had a whole bunch of ESXi hosts,

114
04:36.300 --> 04:40.950
for example, one, two, three, four, five, and six,

115
04:40.950 --> 04:44.580
and these two ESXi hosts right here were in Dev

116
04:44.580 --> 04:47.160
and these four ESXi hosts for participating

117
04:47.160 --> 04:49.260
as part of production,

118
04:49.260 --> 04:51.087
what we could do is create a transport zone.

119
04:51.087 --> 04:53.490
And then we could take these four ESXi hosts,

120
04:53.490 --> 04:54.900
which are enabled for NSX,

121
04:54.900 --> 04:57.960
and associate them and have them support this transport zone

122
04:57.960 --> 04:59.040
called PROD.

123
04:59.040 --> 05:00.270
And then the network segment
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
04:59.040 --> 05:00.270
And then the network segment

124
05:00.270 --> 05:02.760
that's included in that transport zone called PROD

125
05:02.760 --> 05:06.000
will only exist or be available across those four hosts.

126
05:06.000 --> 05:08.160
While these two ESXi hosts over here,

127
05:08.160 --> 05:10.770
if they're supporting a transport zone called Dev,

128
05:10.770 --> 05:12.570
and then we create a new segment

129
05:12.570 --> 05:14.490
that's associated with transport dev,

130
05:14.490 --> 05:17.010
then that NSX segment will only show up

131
05:17.010 --> 05:19.350
and be available on these two hosts.

132
05:19.350 --> 05:21.150
So the transport zone, we can think of it like

133
05:21.150 --> 05:24.360
a way to contain or limit how far

134
05:24.360 --> 05:26.730
a segment in NSX is going to go.

135
05:26.730 --> 05:27.990
Because a segment associated

136
05:27.990 --> 05:29.910
with a transport zone called PROD

137
05:29.910 --> 05:32.490
will only show up on ESXi hosts,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

137
05:29.910 --> 05:32.490
will only show up on ESXi hosts,

138
05:32.490 --> 05:34.050
which again, with NSX enabled,

139
05:34.050 --> 05:36.810
they're referred to as host transport nodes

140
05:36.810 --> 05:38.610
that are supporting that zone.

141
05:38.610 --> 05:39.720
So as part of our game plan,

142
05:39.720 --> 05:42.600
we could use some existing transport zones

143
05:42.600 --> 05:44.430
that come by default with NSX,

144
05:44.430 --> 05:45.690
or we could create our own.

145
05:45.690 --> 05:47.220
And I propose we create our own.

146
05:47.220 --> 05:49.440
Let's create a brand new transport zone,

147
05:49.440 --> 05:51.060
and let's call this new transport zone

148
05:51.060 --> 05:53.670
that we're gonna create Our A-B

149
05:53.670 --> 05:56.880
because we're gonna have both ESXi host A and B

150
05:56.880 --> 05:59.040
support this transport zone we're gonna create.

151
05:59.040 --> 06:01.290
And for transport zones, you can have two types.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

151
05:59.040 --> 06:01.290
And for transport zones, you can have two types.

152
06:01.290 --> 06:04.620
One is gonna be for NSX overlay segments,

153
06:04.620 --> 06:07.380
and the other is gonna be for VLAN-based segments.

154
06:07.380 --> 06:09.390
So we'll go ahead and call this overlay,

155
06:09.390 --> 06:11.970
so that way when we see the name of our transport zone,

156
06:11.970 --> 06:13.620
we'll remember the type it is,

157
06:13.620 --> 06:15.570
and then we'll go ahead and call it TZ.

158
06:15.570 --> 06:16.530
And here's the play by play.

159
06:16.530 --> 06:19.830
When we create a new network segment in NSX,

160
06:19.830 --> 06:21.570
is it a overlay segment,

161
06:21.570 --> 06:24.990
or is it gonna be a VLAN-backed or VLAN-based segment?

162
06:24.990 --> 06:26.190
And for an overlay segment,

163
06:26.190 --> 06:29.340
we'll get to specify which overlay transport zone

164
06:29.340 --> 06:30.990
we want it to belong to.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

164
06:29.340 --> 06:30.990
we want it to belong to.

165
06:30.990 --> 06:33.060
So if e ESXi-A and ESXi-B,

166
06:33.060 --> 06:35.220
both configured as host transport nodes,

167
06:35.220 --> 06:37.950
are both supporting this zone

168
06:37.950 --> 06:40.800
called Our A-B overlay transport zone.

169
06:40.800 --> 06:44.010
Then any new segments that we add to that zone

170
06:44.010 --> 06:46.200
will also be supported by these two hosts.

171
06:46.200 --> 06:48.540
Now, over the years, NSX has been evolving,

172
06:48.540 --> 06:51.720
and currently with NSX version 4.1X,

173
06:51.720 --> 06:55.140
we are gonna be using a vSphere distributed switch.

174
06:55.140 --> 06:57.000
And as the vSphere distributed switch,

175
06:57.000 --> 06:58.950
which we're gonna use as part of NSX

176
06:58.950 --> 07:01.110
as we start adding overlay segments.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

176
06:58.950 --> 07:01.110
as we start adding overlay segments.

177
07:01.110 --> 07:02.340
So if we add overlay segments,

178
07:02.340 --> 07:05.220
they're gonna show up on our vSphere distributed switch.

179
07:05.220 --> 07:07.980
So let's go ahead and create a new distributed switch

180
07:07.980 --> 07:11.130
in vSphere that NSX can then start to use.

181
07:11.130 --> 07:12.570
So for our distributed switch,

182
07:12.570 --> 07:17.490
let's create a new distributed switch called DS for NSX.

183
07:17.490 --> 07:19.530
And that way when we see it, we'll know exactly what it is.

184
07:19.530 --> 07:21.540
Now, when we create this distributed switch,

185
07:21.540 --> 07:23.880
we'll create logical segments like an overlay segment

186
07:23.880 --> 07:25.650
that is then gonna be associated

187
07:25.650 --> 07:27.060
with the distributed switch.

188
07:27.060 --> 07:28.860
And from the vSphere perspective,

189
07:28.860 --> 07:31.950
it simply looks like a port group with a big N,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

189
07:28.860 --> 07:31.950
it simply looks like a port group with a big N,

190
07:31.950 --> 07:33.390
as in Nancy, on it,

191
07:33.390 --> 07:35.940
which represents that this is a segment

192
07:35.940 --> 07:38.220
which looks like a port group on that distributed switch

193
07:38.220 --> 07:39.840
that NSX has created.

194
07:39.840 --> 07:41.700
So we'll create a new distributed switch

195
07:41.700 --> 07:43.770
for NSX to go ahead and use.

196
07:43.770 --> 07:45.120
And also on that distributed switch,

197
07:45.120 --> 07:47.870
we wanna make sure that we have a large enough MTU.

198
07:47.870 --> 07:50.460
So I'm gonna set the MTU to 9,000.

199
07:50.460 --> 07:51.600
That'll be more than enough.

200
07:51.600 --> 07:52.620
So with the Geneve tunneling,

201
07:52.620 --> 07:53.970
because it does add some overhead,

202
07:53.970 --> 07:57.240
they'd like you to have support for at least 1,700 bytes.

203
07:57.240 --> 07:59.370
So if we set up our ESXi distributed switch

204
07:59.370 --> 08:00.570
to support 9,000,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

204
07:59.370 --> 08:00.570
to support 9,000,

205
08:00.570 --> 08:03.420
and our underlying infrastructure also supports that,

206
08:03.420 --> 08:04.500
we'll be good to go.

207
08:04.500 --> 08:06.990
And with all that in place, we then take the final step,

208
08:06.990 --> 08:11.160
and that is to actually add the NSX software to these hosts,

209
08:11.160 --> 08:14.370
ESXi-A and ESXi-B, which once it's done,

210
08:14.370 --> 08:15.690
besides an ESXi host,

211
08:15.690 --> 08:18.450
it also makes them a host transport node

212
08:18.450 --> 08:20.130
in the world of NSX.

213
08:20.130 --> 08:22.860
And again, think of a transport node as the device

214
08:22.860 --> 08:26.850
or the entity that's able to build Geneve tunnels

215
08:26.850 --> 08:30.540
and forward user traffic across those tunnels.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

215
08:26.850 --> 08:30.540
and forward user traffic across those tunnels.

216
08:30.540 --> 08:32.970
And in the case where we have a couple of VMs,

217
08:32.970 --> 08:36.480
let's put VMC right here, that are on the same ESXi host,

218
08:36.480 --> 08:39.750
even if there's layered three routing in NSX

219
08:39.750 --> 08:42.150
that's been set up, the local ESXi host,

220
08:42.150 --> 08:44.100
if it's the host at both these VMs,

221
08:44.100 --> 08:46.140
it can do that logical forwarding

222
08:46.140 --> 08:48.060
directly on his back plane.

223
08:48.060 --> 08:49.980
So that traffic wouldn't even have to go out

224
08:49.980 --> 08:51.060
to the transport network.

225
08:51.060 --> 08:54.690
If it had two VMs that were both connected to NSX segments,

226
08:54.690 --> 08:58.140
ESXi-A as a host transport node could do that movement

227
08:58.140 --> 08:59.790
of the traffic between them

228
08:59.790 --> 09:02.100
without ever having to send it up to the physical network.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

228
08:59.790 --> 09:02.100
without ever having to send it up to the physical network.

229
09:02.100 --> 09:04.830
So again, our last step here is to go ahead and deploy

230
09:04.830 --> 09:08.853
slash configure NSX on the ESXi hosts.