WEBVTT 1 00:00.027 --> 00:01.590 And so for our discussion 2 00:01.590 --> 00:03.971 of logical Layer 3 routing in the world of NSX 3 00:03.971 --> 00:05.040 I think it would be valuable 4 00:05.040 --> 00:07.080 just take a moment and remind ourselves 5 00:07.080 --> 00:09.510 of how that works in a physical environment. 6 00:09.510 --> 00:11.940 So let's imagine that these four segments 7 00:11.940 --> 00:15.120 represent four Layer 2 broadcast domains, 8 00:15.120 --> 00:16.830 like four VLANs, on a network. 9 00:16.830 --> 00:20.730 So let's use VLANs 10, and 20, and 30, and 40, 10 00:20.730 --> 00:21.750 and let's say in those VLANs, 11 00:21.750 --> 00:23.490 we're using the IP addressing space 12 00:23.490 --> 00:26.730 of 10. and we'll just put a V there for the VLAN number, 13 00:26.730 --> 00:30.150 with a 24 bit mask, so that'd be 10.20, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 13 00:26.730 --> 00:30.150 with a 24 bit mask, so that'd be 10.20, 14 00:30.150 --> 00:33.060 this would be 10.30, this would be 10.40, 15 00:33.060 --> 00:34.980 and over here I'll go ahead and put a 10 there as well, 16 00:34.980 --> 00:36.060 just to make it really clear. 17 00:36.060 --> 00:37.320 Then we have devices, 18 00:37.320 --> 00:39.930 printers, computers, servers, et cetera, 19 00:39.930 --> 00:41.310 that are sitting on those networks. 20 00:41.310 --> 00:43.170 And then regarding IP addressing, it's very likely 21 00:43.170 --> 00:45.570 how these clients got their IP address via DHCP, 22 00:45.570 --> 00:47.490 which dynamically assigns the IP address 23 00:47.490 --> 00:49.350 and also the appropriate default gateway. 24 00:49.350 --> 00:51.000 So, on that network segment, 25 00:51.000 --> 00:53.610 if the default gateway is .1 on each one, 26 00:53.610 --> 00:56.220 we can go ahead and draw that in as a node. 27 00:56.220 --> 00:57.630 So I've got a couple routers here 28 00:57.630 --> 01:00.750 to support the 10.10.0 network and 10.20.0 network, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 28 00:57.630 --> 01:00.750 to support the 10.10.0 network and 10.20.0 network, 29 01:00.750 --> 01:02.400 and we can put another one right here. 30 01:02.400 --> 01:04.440 And this router's gonna be directly connected 31 01:04.440 --> 01:05.640 to the 10.30 network, 32 01:05.640 --> 01:08.190 and this router right here is directly connected 33 01:08.190 --> 01:09.450 to the 10.40 network. 34 01:09.450 --> 01:10.283 And in a production network, 35 01:10.283 --> 01:11.880 it's not too likely that each of these 36 01:11.880 --> 01:13.650 is gonna be separate physical routers 37 01:13.650 --> 01:15.510 because we have these multi-layer switches 38 01:15.510 --> 01:17.700 with logical Layer 3 routing built into them. 39 01:17.700 --> 01:20.400 But this just represents a Layer 3 routing function 40 01:20.400 --> 01:22.500 that's available to each of these subnets. 41 01:22.500 --> 01:24.090 Now currently there's just one interface each, 42 01:24.090 --> 01:26.250 they're not able to actually do routing to other subnets, 43 01:26.250 --> 01:29.788 so it's also likely we'd have another router here, 44 01:29.788 --> 01:31.590 and then we'll put some connectivity here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 44 01:29.788 --> 01:31.590 and then we'll put some connectivity here, 45 01:31.590 --> 01:33.960 again, this could be a logical representation 46 01:33.960 --> 01:35.460 of how our network is set up. 47 01:35.460 --> 01:37.680 Again, these don't have to be physical external devices, 48 01:37.680 --> 01:40.470 they could be logical Layer 3 routing functions, 49 01:40.470 --> 01:43.680 for example, built in as part of a multi-layer switch, 50 01:43.680 --> 01:44.970 or we could have a firewall 51 01:44.970 --> 01:47.160 that's providing the Layer 3 routing. 52 01:47.160 --> 01:48.210 And for these connections here, 53 01:48.210 --> 01:50.460 it's very common to use, for example, a /30 54 01:50.460 --> 01:54.480 or, when the topology and the gear allows it, a /31, 55 01:54.480 --> 01:56.370 to not waste too many IP addresses. 56 01:56.370 --> 01:59.790 Or if we're using private RFC 1918 address space, as we are, 57 01:59.790 --> 02:01.170 maybe it doesn't matter too much WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 57 01:59.790 --> 02:01.170 maybe it doesn't matter too much 58 02:01.170 --> 02:03.390 because we have tons of IP address space to play with. 59 02:03.390 --> 02:08.390 So for our topology example here, let's use 100.64.0.0/30, 60 02:10.770 --> 02:12.870 and then this guy over here could be .1, 61 02:12.870 --> 02:14.880 and this guy over here could be .2. 62 02:14.880 --> 02:16.890 And over here let's go ahead and use the subnet 63 02:16.890 --> 02:21.890 of 100.64.0.4/30, and this guy could use .5, 64 02:23.280 --> 02:24.810 and this one could use .6. 65 02:24.810 --> 02:26.940 And over here we'll go ahead and make this subnet 66 02:26.940 --> 02:28.770 for that last octet, that'd be eight 67 02:28.770 --> 02:31.110 if we're using a /30 and going contiguously, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 67 02:28.770 --> 02:31.110 if we're using a /30 and going contiguously, 68 02:31.110 --> 02:33.927 so this would be .9, this would be .10, 69 02:33.927 --> 02:35.910 and this would be subnet 12, 70 02:35.910 --> 02:38.970 and then this could be .13, and this could be .14. 71 02:38.970 --> 02:40.230 So if we have this computer over here, 72 02:40.230 --> 02:41.610 we'll call this computer A, 73 02:41.610 --> 02:44.040 that's communicating with this device right here, 74 02:44.040 --> 02:45.840 we'll call this device D, 75 02:45.840 --> 02:48.000 that could be a user communicating with the server 76 02:48.000 --> 02:49.950 or it could be a web or application server 77 02:49.950 --> 02:51.600 talking to a database, et cetera, 78 02:51.600 --> 02:53.430 just two different points on the network 79 02:53.430 --> 02:54.930 that need to communicate with each other 80 02:54.930 --> 02:58.140 from the 10.10.0 network over here to the 10.40 network. 81 02:58.140 --> 02:59.310 And to simplify addressing, 82 02:59.310 --> 03:01.680 let's give this guy the host address at the end of .10, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 82 02:59.310 --> 03:01.680 let's give this guy the host address at the end of .10, 83 03:01.680 --> 03:04.320 and over here we'll give this guy the address of .40. 84 03:04.320 --> 03:06.284 So over here, this is 10.40.0.40, 85 03:06.284 --> 03:08.250 over here this is 10.10.0.10. 86 03:08.250 --> 03:09.510 So each of these devices 87 03:09.510 --> 03:11.850 has a default gateway on their local segment 88 03:11.850 --> 03:13.230 that they've been configured for, 89 03:13.230 --> 03:14.610 and then from a routing perspective, 90 03:14.610 --> 03:15.630 to make sure all the routers 91 03:15.630 --> 03:18.300 can actually make correct forwarding decisions 92 03:18.300 --> 03:20.490 from left to right and from right to left, 93 03:20.490 --> 03:23.490 which can also be referred to as east-west routing, 94 03:23.490 --> 03:25.380 that can be provided as long as all these routers 95 03:25.380 --> 03:27.480 have appropriate routes in their routing table. 96 03:27.480 --> 03:29.310 So one way of doing that would be static routes 97 03:29.310 --> 03:31.290 on all these devices or, even better yet, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 97 03:29.310 --> 03:31.290 on all these devices or, even better yet, 98 03:31.290 --> 03:32.970 a dynamic routing protocol 99 03:32.970 --> 03:36.120 to let them share with each other reachability information 100 03:36.120 --> 03:38.370 to update their respective routing tables. 101 03:38.370 --> 03:41.100 And that way if have host A needs to forward a packet 102 03:41.100 --> 03:44.670 over to 10.40.0.10, it forwards it to its default gateway. 103 03:44.670 --> 03:46.140 So the forwarding would happen 104 03:46.140 --> 03:47.820 on the Layer 2 local segment, 105 03:47.820 --> 03:48.990 the actual frame at Layer 2 106 03:48.990 --> 03:50.670 would be forwarded to the Mac address 107 03:50.670 --> 03:51.960 of the default gateway. 108 03:51.960 --> 03:53.790 But at Layer 3, the IP address 109 03:53.790 --> 03:56.160 would have the destination of 10.40.0.40, 110 03:56.160 --> 03:58.440 at which point this router would look at its routing table, 111 03:58.440 --> 03:59.820 make a forwarding decision 112 03:59.820 --> 04:01.920 to what it believed was the appropriate next hop, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 112 03:59.820 --> 04:01.920 to what it believed was the appropriate next hop, 113 04:01.920 --> 04:03.270 and this router did the same thing, 114 04:03.270 --> 04:04.530 do a route lookup first, 115 04:04.530 --> 04:07.680 and then forward it to the correct next Layer 2 address 116 04:07.680 --> 04:08.550 in the path. 117 04:08.550 --> 04:10.500 So that way when this router gets it right here, 118 04:10.500 --> 04:12.960 it does a route lookup, says, oh, I'm directly connected, 119 04:12.960 --> 04:14.670 and it can look up the Layer 2 address 120 04:14.670 --> 04:16.410 and forward it to that destination. 121 04:16.410 --> 04:19.050 And the way that a device connected to an IPv4 network 122 04:19.050 --> 04:20.610 finds out the layer to address, 123 04:20.610 --> 04:21.630 if it doesn't already know it, 124 04:21.630 --> 04:23.460 is that it makes an ARP request. 125 04:23.460 --> 04:26.310 Think of it like shouting into this network, or this router, 126 04:26.310 --> 04:27.143 shouting into the network, 127 04:27.143 --> 04:30.000 says, hey, I don't yet know what the Layer 2 address is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 128 04:30.000 --> 04:32.400 of this host at 10.40.0.40, 129 04:32.400 --> 04:33.990 I'd really like to know what that is, 130 04:33.990 --> 04:35.310 if you own that address, 131 04:35.310 --> 04:37.230 please respond back with an ARP reply. 132 04:37.230 --> 04:39.780 At which point this router then learns the Layer 2 address 133 04:39.780 --> 04:41.700 of that locally connected network device, 134 04:41.700 --> 04:43.890 and it could forward the frame at Layer 2 135 04:43.890 --> 04:45.540 to the correct Layer 2 Mac address, 136 04:45.540 --> 04:47.850 while at Layer 3 we still have the destination IP address 137 04:47.850 --> 04:49.830 of 10.40.0.40. 138 04:49.830 --> 04:51.600 So that handles the east-west traffic, 139 04:51.600 --> 04:53.850 the traffic going left to right and right to left, 140 04:53.850 --> 04:55.200 inside of this topology, 141 04:55.200 --> 04:59.160 but what about access to networks outside of the scope here? 142 04:59.160 --> 05:01.020 For example, we may have devices here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 142 04:59.160 --> 05:01.020 For example, we may have devices here 143 05:01.020 --> 05:04.020 that need to communicate to some other data center, 144 05:04.020 --> 05:05.070 or to the internet, 145 05:05.070 --> 05:08.040 or something that's not just right here in the topology. 146 05:08.040 --> 05:10.020 And so if this router has a default route that says, 147 05:10.020 --> 05:12.810 hey, if you don't have a better route in your routing table, 148 05:12.810 --> 05:15.180 just forward it off to this next hop for your default route, 149 05:15.180 --> 05:17.370 and then it's that person, or that entity's job 150 05:17.370 --> 05:18.630 to continue forwarding. 151 05:18.630 --> 05:20.340 So in that case, if this client here 152 05:20.340 --> 05:23.610 needed to get out to, for example, 8.8.8.8, 153 05:23.610 --> 05:25.320 which represents an IP address 154 05:25.320 --> 05:27.540 that's external to this little topology here, 155 05:27.540 --> 05:29.280 this router, acting as the default gateway, 156 05:29.280 --> 05:31.650 would then forward it based on its routing table, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 156 05:29.280 --> 05:31.650 would then forward it based on its routing table, 157 05:31.650 --> 05:32.730 and then this router would forward it 158 05:32.730 --> 05:35.070 based on its routing table, and that would take care 159 05:35.070 --> 05:37.380 of our north-south traffic. 160 05:37.380 --> 05:40.710 Or if I wanted to clean up those arrows a little bit, 161 05:40.710 --> 05:43.440 for the north-south traffic let me draw arrows like this, 162 05:43.440 --> 05:47.280 and for the east-west traffic let me draw arrows like this. 163 05:47.280 --> 05:48.510 And if we do that, check it out, 164 05:48.510 --> 05:51.000 that looks like the router arrows as well. 165 05:51.000 --> 05:52.740 Now in combination with this, 166 05:52.740 --> 05:56.700 if we have RFC 1918 addresses, private addresses 167 05:56.700 --> 05:58.200 we're using down here, like we are, 168 05:58.200 --> 06:00.330 and we're going out to the public internet, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 168 05:58.200 --> 06:00.330 and we're going out to the public internet, 169 06:00.330 --> 06:02.040 at some point we're gonna need some network services, 170 06:02.040 --> 06:03.810 like network address translation, 171 06:03.810 --> 06:05.220 to swap out our source address 172 06:05.220 --> 06:07.290 before that traffic goes out on the public internet. 173 06:07.290 --> 06:09.600 Also, for a lot of clients to get IP addresses, 174 06:09.600 --> 06:11.040 we might need some services, 175 06:11.040 --> 06:13.260 like dynamic host configuration protocol, 176 06:13.260 --> 06:15.030 to dynamically assign addresses. 177 06:15.030 --> 06:17.880 Those are examples of some of the common IP network services 178 06:17.880 --> 06:19.680 that we have in our common networks today. 179 06:19.680 --> 06:21.720 Well, let me put a little dividing line here, 180 06:21.720 --> 06:23.280 and let's talk about how we could implement 181 06:23.280 --> 06:26.670 something similar to this, but do it in software, 182 06:26.670 --> 06:28.530 with the software defined networking 183 06:28.530 --> 06:31.470 specifically implementing all these routing features WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 183 06:28.530 --> 06:31.470 specifically implementing all these routing features 184 06:31.470 --> 06:32.820 inside of NSX. 185 06:32.820 --> 06:33.653 So to do that, 186 06:33.653 --> 06:35.580 I'm gonna start off with our external network here, 187 06:35.580 --> 06:38.280 or at least a cloud to represent an external network, 188 06:38.280 --> 06:41.010 outside the world of our NSX routing, 189 06:41.010 --> 06:42.750 and I'll just label this external. 190 06:42.750 --> 06:45.360 So what we do in NSX is we create a logical gateway, 191 06:45.360 --> 06:46.560 and this logical gateway 192 06:46.560 --> 06:48.750 that's connected to our external networks, 193 06:48.750 --> 06:51.510 it's referred to as a tier-0 gateway, 194 06:51.510 --> 06:53.640 but you can think of it just like a router 195 06:53.640 --> 06:55.440 that's connected to the external network. 196 06:55.440 --> 06:56.760 And just like any good router, 197 06:56.760 --> 06:59.010 it's gonna need information, and routing information, 198 06:59.010 --> 07:01.050 in its tables about how to forward packets. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 198 06:59.010 --> 07:01.050 in its tables about how to forward packets. 199 07:01.050 --> 07:03.180 So maybe we have a default route that says, hey, 200 07:03.180 --> 07:04.740 if you don't have a more detailed route 201 07:04.740 --> 07:06.630 in your routing table, go ahead and forward it 202 07:06.630 --> 07:07.770 to the next hop address 203 07:07.770 --> 07:09.930 that is leading to this external network. 204 07:09.930 --> 07:12.120 And at this point, we could take this tier-0 router, 205 07:12.120 --> 07:13.590 which is connected to the external network, 206 07:13.590 --> 07:15.360 and we could also just connect it 207 07:15.360 --> 07:17.220 to our four segments right here. 208 07:17.220 --> 07:21.180 So, these are four subnets, and in the world of NSX, 209 07:21.180 --> 07:23.280 we could have those same four subnets 210 07:23.280 --> 07:24.870 but these Layer 2 broadcast domains 211 07:24.870 --> 07:26.460 that are supporting each of these subnets, 212 07:26.460 --> 07:28.050 they could be overlay segments. 213 07:28.050 --> 07:29.910 Because at the end of the day, an overlay segment, 214 07:29.910 --> 07:31.920 in the eyes of the clients who are connected to them, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 214 07:29.910 --> 07:31.920 in the eyes of the clients who are connected to them, 215 07:31.920 --> 07:35.190 is just a logical Layer 2 broadcast domain, 216 07:35.190 --> 07:36.540 and in association with that, 217 07:36.540 --> 07:39.210 they're also using a common IP subnet. 218 07:39.210 --> 07:40.043 So, I'm gonna go ahead 219 07:40.043 --> 07:43.260 and call this subnet 10, and 20, and 30, and 40, 220 07:43.260 --> 07:45.750 and we could use the same IP addressing we did over here. 221 07:45.750 --> 07:48.000 And then this logical gateway function 222 07:48.000 --> 07:50.400 could provide the inter-VLAN routing right here 223 07:50.400 --> 07:53.310 or in this case, in NSX, the intersegment routing, 224 07:53.310 --> 07:55.410 between these various IPv4 subnets 225 07:55.410 --> 07:58.050 and also provide connectivity to the outside world. 226 07:58.050 --> 08:00.810 So once again, we have north-south routing WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 226 07:58.050 --> 08:00.810 So once again, we have north-south routing 227 08:00.810 --> 08:02.940 from clients going into and out of 228 08:02.940 --> 08:04.590 this NSX routing environment, 229 08:04.590 --> 08:05.910 and we also have the east-west, 230 08:05.910 --> 08:07.650 for client A for example, over here, 231 08:07.650 --> 08:10.530 trying to communicate with device D over here 232 08:10.530 --> 08:12.840 on the other subnet, the 10.40.0 network. 233 08:12.840 --> 08:15.420 However, for scalability, it's often common 234 08:15.420 --> 08:18.360 to add yet another level of logical Layer 3 routers, 235 08:18.360 --> 08:21.210 for example, very similar to what we have over here. 236 08:21.210 --> 08:24.150 And in the world of NSX, this next level right here, 237 08:24.150 --> 08:25.800 representing these orange routers, 238 08:25.800 --> 08:28.860 those are referred to as tier-1 routers. 239 08:28.860 --> 08:32.400 So we'll call this one tier-1 gateway-A, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 239 08:28.860 --> 08:32.400 So we'll call this one tier-1 gateway-A, 240 08:32.400 --> 08:33.450 and because we have two of 'em, 241 08:33.450 --> 08:36.960 I'll call this one tier-1 gateway-B. 242 08:36.960 --> 08:39.120 And again, we could put in four here, like I have here, 243 08:39.120 --> 08:40.620 but I'm running out of space. 244 08:40.620 --> 08:43.080 So I'm gonna go ahead and consolidate just a little bit, 245 08:43.080 --> 08:46.380 simply by using two routers at the tier-1 level 246 08:46.380 --> 08:47.970 instead of four as we have here. 247 08:47.970 --> 08:49.170 And so, if we have four segments, 248 08:49.170 --> 08:51.900 what we could do is put a couple here, and a couple here, 249 08:51.900 --> 08:52.950 and we're good to go. 250 08:52.950 --> 08:55.380 So there's our four network segments, 251 08:55.380 --> 08:57.480 so this could be segment 10, segment 20, 252 08:57.480 --> 08:59.370 segment 30, segment 40. 253 08:59.370 --> 09:01.230 We still have client A over here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 253 08:59.370 --> 09:01.230 We still have client A over here, 254 09:01.230 --> 09:03.090 we still have client D over here, 255 09:03.090 --> 09:05.130 and we're still using the same IP addressing space 256 09:05.130 --> 09:07.050 we had in our original topology. 257 09:07.050 --> 09:08.730 So for the east-west traffic, 258 09:08.730 --> 09:10.590 that can all be routed this way. 259 09:10.590 --> 09:14.160 So, for example, this client at 10.10.0.10 260 09:14.160 --> 09:15.840 needs to communicate with this device over here 261 09:15.840 --> 09:18.510 at 10.40.0.40. 262 09:18.510 --> 09:19.380 This client would say, 263 09:19.380 --> 09:21.510 oh, that destination is not on my local subnet, 264 09:21.510 --> 09:23.430 it would forward it to its default gateway, 265 09:23.430 --> 09:25.470 the router would make a routing decision. 266 09:25.470 --> 09:27.150 In this topology, as shown, 267 09:27.150 --> 09:29.430 that traffic would be routed to the tier-0 gateway 268 09:29.430 --> 09:31.590 who would then make your routing decision down here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 268 09:29.430 --> 09:31.590 who would then make your routing decision down here, 269 09:31.590 --> 09:33.060 who would then deliver it down here. 270 09:33.060 --> 09:35.190 So the routing decisions are made first, 271 09:35.190 --> 09:36.930 and then once they've sorted out the Layer 3 routing, 272 09:36.930 --> 09:38.820 what they believe is the next best hop, 273 09:38.820 --> 09:40.860 they'll go ahead and resolve the Layer 2 address 274 09:40.860 --> 09:43.410 for that next hop, and then forward that traffic 275 09:43.410 --> 09:44.340 to the next hop. 276 09:44.340 --> 09:47.340 Or if a client, like client A, needed access to the internet 277 09:47.340 --> 09:50.760 or some resource outside of our local NSX environment here, 278 09:50.760 --> 09:52.440 the client would forward, once again, 279 09:52.440 --> 09:53.880 to their default gateway. 280 09:53.880 --> 09:55.620 The default gateway, based on its routing table, 281 09:55.620 --> 09:57.450 would forward it to the next logical hop. 282 09:57.450 --> 09:59.130 And then in this case, our tier-0 router 283 09:59.130 --> 10:01.320 would forward that packet to the next appropriate hop WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 283 09:59.130 --> 10:01.320 would forward that packet to the next appropriate hop 284 10:01.320 --> 10:02.490 based on it's routing table, 285 10:02.490 --> 10:03.840 and then that packet would be sent 286 10:03.840 --> 10:05.190 on, and on, and on through the internet, 287 10:05.190 --> 10:07.680 or wherever that packet was destined to go 288 10:07.680 --> 10:09.870 based on the routing tables on those routers. 289 10:09.870 --> 10:12.480 So that'd be an example of the north-south routing 290 10:12.480 --> 10:13.533 in this topology.