WEBVTT 1 00:00.210 --> 00:02.208 So, as we begin the integration 2 00:02.208 --> 00:05.700 of layer three gateways in the world of NSX, 3 00:05.700 --> 00:06.750 one of the best things 4 00:06.750 --> 00:10.080 we can do for ourselves is to start small. 5 00:10.080 --> 00:11.520 For this set of videos, 6 00:11.520 --> 00:15.540 I'd think to start off with a tier one gateway 7 00:15.540 --> 00:18.360 and focus on the east-west routing. 8 00:18.360 --> 00:19.193 An example of that 9 00:19.193 --> 00:21.150 would be having this logical gateway route 10 00:21.150 --> 00:22.890 between our segment 10, 11 00:22.890 --> 00:26.280 which we created in a previous skill, and segment 20, 12 00:26.280 --> 00:28.890 which we already created also in a previous skill. 13 00:28.890 --> 00:31.680 So, let's go ahead and put device A right here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 13 00:28.890 --> 00:31.680 So, let's go ahead and put device A right here 14 00:31.680 --> 00:33.900 and device B right here, 15 00:33.900 --> 00:36.780 meaning two devices connected to that segment 10. 16 00:36.780 --> 00:37.920 And then, over here, let's go ahead 17 00:37.920 --> 00:40.950 and put device A over here on this segment 18 00:40.950 --> 00:42.630 and device B over here. 19 00:42.630 --> 00:43.740 So, for IP addressing, 20 00:43.740 --> 00:47.760 we're using 10.10.0.0 over here with the 24 bit mask. 21 00:47.760 --> 00:48.780 And over here on segment 20, 22 00:48.780 --> 00:52.710 we're using 10.20.0.0 with a 24 bit mask. 23 00:52.710 --> 00:56.100 And let's say this device is at .10 and this is at .11. 24 00:56.100 --> 00:57.570 And over here just for grins, 25 00:57.570 --> 01:00.390 let's say this is .20, and this is .21. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 25 00:57.570 --> 01:00.390 let's say this is .20, and this is .21. 26 01:00.390 --> 01:03.090 So, these devices here on the 10.10.0 network, 27 01:03.090 --> 01:04.350 they would have a default gateway. 28 01:04.350 --> 01:06.750 Let's imagine we're using .1 here and .1 here. 29 01:06.750 --> 01:09.147 They would have their default gateway set to 10.10.01. 30 01:09.147 --> 01:12.630 And over here, their default gateway would be 10.20.01. 31 01:12.630 --> 01:14.310 And then, this router, this gateway, 32 01:14.310 --> 01:17.130 because it's directly connected to both of those segments, 33 01:17.130 --> 01:18.090 in its routing table, 34 01:18.090 --> 01:20.130 it's gonna know, hey, I can reach both those networks. 35 01:20.130 --> 01:21.120 So, at this point, we wouldn't have 36 01:21.120 --> 01:24.330 to really worry about any additional routing information 37 01:24.330 --> 01:26.760 other than the two directly connected networks 38 01:26.760 --> 01:29.220 that this tier one gateway is connected to, 39 01:29.220 --> 01:32.340 to be able to facilitate the routing between east-west here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 39 01:29.220 --> 01:32.340 to be able to facilitate the routing between east-west here, 40 01:32.340 --> 01:34.740 left to right and right to left, inside the data center. 41 01:34.740 --> 01:37.050 So, now that we've taken a look at east to west routing 42 01:37.050 --> 01:38.610 with logical layer three routing 43 01:38.610 --> 01:41.610 and also direct connectivity within a subnet, 44 01:41.610 --> 01:43.830 let's also take a look at an additional challenge. 45 01:43.830 --> 01:48.830 And that is this VM right here, VM-A on the 10.10.0 network 46 01:48.960 --> 01:50.550 and this VM right here, 47 01:50.550 --> 01:53.310 VM-A over here on the 10.20.0 network, 48 01:53.310 --> 01:57.630 what if it's the same ESXi host, let's say it's ESXi-A, 49 01:57.630 --> 01:59.520 that's providing the compute resources 50 01:59.520 --> 02:02.790 for the VM-A over on segment 10, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 50 01:59.520 --> 02:02.790 for the VM-A over on segment 10, 51 02:02.790 --> 02:05.700 and it's also the compute resource for VM-A, 52 02:05.700 --> 02:07.590 which is over on segment 20. 53 02:07.590 --> 02:09.120 If these two devices were communicating 54 02:09.120 --> 02:10.710 with each other in a physical environment, 55 02:10.710 --> 02:13.800 that traffic would have to leave the hypervisor, 56 02:13.800 --> 02:15.210 go to the router function. 57 02:15.210 --> 02:17.760 The router would then forward it down to the destination, 58 02:17.760 --> 02:20.640 and then the return path would go like this and back over, 59 02:20.640 --> 02:22.500 which means if we have an ESXi host 60 02:22.500 --> 02:25.133 with both of these VMs running, the traffic 61 02:25.133 --> 02:25.966 (indistinct) 62 02:25.966 --> 02:27.900 here and then back over here. 63 02:27.900 --> 02:31.740 And here is the most fantastic news about NSX. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 63 02:27.900 --> 02:31.740 And here is the most fantastic news about NSX. 64 02:31.740 --> 02:34.650 We are gonna use the concept of a distributed router, 65 02:34.650 --> 02:36.600 or in the context of talking about NSX 66 02:36.600 --> 02:38.880 and logical gateways, we could call it a DR, 67 02:38.880 --> 02:39.780 not to be confused 68 02:39.780 --> 02:42.630 with a designated router in the world of OSPF. 69 02:42.630 --> 02:43.680 And here's what that means. 70 02:43.680 --> 02:45.630 It means that the routing information 71 02:45.630 --> 02:47.370 that this gateway is providing, 72 02:47.370 --> 02:48.990 because it's a logical router, 73 02:48.990 --> 02:50.610 not only does that routing information 74 02:50.610 --> 02:52.938 exist here on this logical layer three gateway, 75 02:52.938 --> 02:56.070 but this distributed router, this DR function is here. 76 02:56.070 --> 02:58.680 And it's also on our hosts. 77 02:58.680 --> 03:01.413 So, our host know the whole plan about routing WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 77 02:58.680 --> 03:01.413 So, our host know the whole plan about routing 78 03:01.413 --> 03:05.100 between the 10.10.0 network and the 10.20.0 network, 79 03:05.100 --> 03:06.120 because all that routing 80 03:06.120 --> 03:09.480 information exists on the ESXi host. 81 03:09.480 --> 03:12.360 And as a result, if this client here on host A 82 03:12.360 --> 03:14.160 wanted to talk to this client here, 83 03:14.160 --> 03:16.890 the actual physical routing of that traffic 84 03:16.890 --> 03:19.530 wouldn't have to physically go out to the outside world 85 03:19.530 --> 03:21.000 or physically be sent over 86 03:21.000 --> 03:23.550 to this entity called our gateway here, 87 03:23.550 --> 03:25.050 this tier one gateway. 88 03:25.050 --> 03:26.820 But instead, because the ESXi 89 03:26.820 --> 03:28.320 has all that routing information, 90 03:28.320 --> 03:30.840 it's just gonna make a logical routing decision WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 90 03:28.320 --> 03:30.840 it's just gonna make a logical routing decision 91 03:30.840 --> 03:33.390 in its own brain using the information 92 03:33.390 --> 03:34.410 from the distributed router 93 03:34.410 --> 03:36.600 and make that routing decision locally. 94 03:36.600 --> 03:40.500 So, that traffic between this VM here and this VM here 95 03:40.500 --> 03:44.820 does not have to physically go out of this ESXi host. 96 03:44.820 --> 03:47.160 And that traffic never needs to actually leave. 97 03:47.160 --> 03:50.040 It can be routed east-west right here logically 98 03:50.040 --> 03:53.310 on this ESXi host, which is hosting both of those VMs. 99 03:53.310 --> 03:54.810 So, let's imagine the other two VMs 100 03:54.810 --> 03:58.320 are being hosted on the compute resource called ESXi-B. 101 03:58.320 --> 03:59.302 So, that'll be right here. 102 03:59.302 --> 04:01.320 And it has a couple VMs that's running. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 102 03:59.302 --> 04:01.320 And it has a couple VMs that's running. 103 04:01.320 --> 04:04.060 It's running VM-B on segment 10, 104 04:04.060 --> 04:07.230 and it's also running VM-B on segment 20. 105 04:07.230 --> 04:10.050 And again, the cool thing, if this is a host transport node, 106 04:10.050 --> 04:13.050 it has a copy of the distributed router 107 04:13.050 --> 04:16.950 logically running on this ESXi host transport node. 108 04:16.950 --> 04:18.630 And so, if traffic needs to be routed 109 04:18.630 --> 04:20.250 between these two devices, 110 04:20.250 --> 04:21.660 it can make all the routing decisions 111 04:21.660 --> 04:23.550 between the subnet 10.10 and 10.20 112 04:23.550 --> 04:25.560 and make the forwarding decision between those, 113 04:25.560 --> 04:27.630 and that traffic between these two VMs 114 04:27.630 --> 04:31.560 never has to leave the actual ESXi-B host. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 114 04:27.630 --> 04:31.560 never has to leave the actual ESXi-B host. 115 04:31.560 --> 04:33.570 And in the event that traffic needs to flow 116 04:33.570 --> 04:36.240 from any of the VMs that ESXi-B is hosting 117 04:36.240 --> 04:39.690 to any of the VMs that ESXi-A is hosting, at that point, 118 04:39.690 --> 04:41.640 these hosts, they have a complete picture 119 04:41.640 --> 04:43.380 of the distributed routing table. 120 04:43.380 --> 04:44.640 So, they know how to forward. 121 04:44.640 --> 04:46.929 But as far as looking up the layer two address, 122 04:46.929 --> 04:48.900 they would respectively realize 123 04:48.900 --> 04:52.650 that that's reachable over on the other ESXi host. 124 04:52.650 --> 04:54.300 And so, I'll put a little tunnel here, 125 04:54.300 --> 04:56.070 and that would go between their tunnel endpoints, 126 04:56.070 --> 04:58.680 so the traffic between VM-B, for example, 127 04:58.680 --> 05:00.270 and either these two hosts, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 127 04:58.680 --> 05:00.270 and either these two hosts, 128 05:00.270 --> 05:02.730 would be encapsulated and shipped over the tunnel. 129 05:02.730 --> 05:04.770 And another really important consideration 130 05:04.770 --> 05:07.564 with NSX is the concept of don't wait, 131 05:07.564 --> 05:10.110 don't wait to make a routing decision, 132 05:10.110 --> 05:12.330 because each of these ESXi hosts, 133 05:12.330 --> 05:15.420 they have the distributed router component on them 134 05:15.420 --> 05:17.490 if they are connected to those segments 135 05:17.490 --> 05:19.020 and they have VMs that are connected, 136 05:19.020 --> 05:20.310 they'll automatically get a copy 137 05:20.310 --> 05:22.620 of the distributed router and the routing tables there. 138 05:22.620 --> 05:24.720 So, if we had traffic, they need to go, for example, 139 05:24.720 --> 05:27.750 from VM-A at 10.10.0.10 140 05:27.750 --> 05:31.410 over here to VM-B on segment 20, which is at 10.20.0.21. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 140 05:27.750 --> 05:31.410 over here to VM-B on segment 20, which is at 10.20.0.21. 141 05:31.410 --> 05:32.760 The part about don't wait means 142 05:32.760 --> 05:36.510 because ESXi is the originating host that has VM-A 143 05:36.510 --> 05:39.150 and it also has the distributed router 144 05:39.150 --> 05:41.100 on all the routing information right there, 145 05:41.100 --> 05:42.450 locally here on ESXi-A, 146 05:42.450 --> 05:44.010 it's not gonna wait to make a routing decision. 147 05:44.010 --> 05:44.843 It's gonna say, you know what? 148 05:44.843 --> 05:47.070 This client lives on segment 10, 149 05:47.070 --> 05:48.660 which is the 10.10.0 network, 150 05:48.660 --> 05:50.190 and it's trying to get to 10.20, 151 05:50.190 --> 05:52.320 which is the segment 20 network. 152 05:52.320 --> 05:54.690 It'll make that routing decision right here in its brain, 153 05:54.690 --> 05:56.928 identify that it needs to go to segment 20. 154 05:56.928 --> 05:57.761 And then, we'll go ahead 155 05:57.761 --> 05:59.400 and forward that over the tunnel end points. 156 05:59.400 --> 06:01.200 And so, here in this GENEVE tunnel, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 156 05:59.400 --> 06:01.200 And so, here in this GENEVE tunnel, 157 06:01.200 --> 06:03.300 the destination would have the VLAN identifier 158 06:03.300 --> 06:05.040 of this target network here 159 06:05.040 --> 06:07.020 that's being supported by segment 20. 160 06:07.020 --> 06:08.820 And the reverse of that is also true. 161 06:08.820 --> 06:09.840 So, if that traffic 162 06:09.840 --> 06:13.080 showed up at this VM-B here at 10.20.0.21, 163 06:13.080 --> 06:14.700 and it's gonna respond back to VM-A 164 06:14.700 --> 06:16.892 over here at 10.10.0.10, 165 06:16.892 --> 06:19.814 ESXi-B, who's hosting the original VM, 166 06:19.814 --> 06:21.750 would make that routing decisions. 167 06:21.750 --> 06:22.860 So, the traffic is gonna start 168 06:22.860 --> 06:25.110 from a VM on this segment right here. 169 06:25.110 --> 06:27.150 It'll make a routing decision locally, 170 06:27.150 --> 06:29.430 because it has a copy of that distributed router function, 171 06:29.430 --> 06:31.260 knows all the details about the routing, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 171 06:29.430 --> 06:31.260 knows all the details about the routing, 172 06:31.260 --> 06:34.320 would specify that the target is on the segment 173 06:34.320 --> 06:36.240 that's supporting the 10.10.0 network, 174 06:36.240 --> 06:37.380 because the layer two address 175 06:37.380 --> 06:39.690 of the target is on another host. 176 06:39.690 --> 06:42.840 And all that information is being maintained by NSX. 177 06:42.840 --> 06:45.570 ESXi-B says all that destination layer two address, 178 06:45.570 --> 06:49.290 it's not on one of my local VMs, it's owned by ESXi-A. 179 06:49.290 --> 06:50.160 And that's what causes it 180 06:50.160 --> 06:52.500 to forward the entire original payload, 181 06:52.500 --> 06:55.680 which includes the source MAC address of VM-B 182 06:55.680 --> 06:57.827 and the destination MAC address of VM-A, and forward that. 183 06:57.827 --> 07:00.720 So, if the original traffic was like a ping request, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 183 06:57.827 --> 07:00.720 So, if the original traffic was like a ping request, 184 07:00.720 --> 07:04.050 then coming back would be a ICMP echo reply, 185 07:04.050 --> 07:06.423 a response effectively to that ping request.