WEBVTT

1
00:00.210 --> 00:02.490
All right, so for our game plan,

2
00:02.490 --> 00:04.320
I know there's a lot on the screen right here,

3
00:04.320 --> 00:06.330
but I wanted to go ahead and just reinforce

4
00:06.330 --> 00:08.490
what we've already put in place up to this point

5
00:08.490 --> 00:10.140
and just carry that forward.

6
00:10.140 --> 00:13.170
So as part of our game plan, let's do a validation

7
00:13.170 --> 00:14.850
of our current implementation.

8
00:14.850 --> 00:17.940
'Cause in the previous video we created a couple segments,

9
00:17.940 --> 00:19.770
segment 10, segment 20,

10
00:19.770 --> 00:22.770
we have a couple of VMs on each segment, on each host.

11
00:22.770 --> 00:25.500
And currently, because we don't have any layer three routing

12
00:25.500 --> 00:27.390
between those two segments

13
00:27.390 --> 00:29.640
and the subnets associated with those segments,

14
00:29.640 --> 00:33.150
the devices here on segment 10 don't have a default gateway
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:29.640 --> 00:33.150
the devices here on segment 10 don't have a default gateway

15
00:33.150 --> 00:35.370
they can use to communicate with devices over here

16
00:35.370 --> 00:36.330
on Segment 20.

17
00:36.330 --> 00:38.970
So the first thing I'd like to do is simply validate our

18
00:38.970 --> 00:41.670
current infrastructure with these two segments

19
00:41.670 --> 00:43.950
to verify they exist and also to make sure we have

20
00:43.950 --> 00:45.660
these four VMs set up and ready to go.

21
00:45.660 --> 00:47.400
And now, as part of that in the background,

22
00:47.400 --> 00:50.433
we're gonna have a separate skill on DHCP services,

23
00:50.433 --> 00:53.250
but for this skill, just for a little sanity,

24
00:53.250 --> 00:57.090
for my own benefit, I'm gonna set up in the background DHCP

25
00:57.090 --> 01:01.020
services so that when we bring up these VMs on segment 10,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:57.090 --> 01:01.020
services so that when we bring up these VMs on segment 10,

26
01:01.020 --> 01:03.087
they'll automatically get an IP address in the

27
01:03.087 --> 01:04.980
10, 10, 0 subnet,

28
01:04.980 --> 01:07.440
and over here on Segment 20, when they boot up,

29
01:07.440 --> 01:09.270
they'll automatically get an IP address in the

30
01:09.270 --> 01:10.800
10, 20, 0 subnet.

31
01:10.800 --> 01:12.510
And then later we'll have more time

32
01:12.510 --> 01:15.210
to focus our attention on a whole variety and range

33
01:15.210 --> 01:17.760
of DHCP services as part of NSX.

34
01:17.760 --> 01:19.290
So for now, I just wanna make you aware

35
01:19.290 --> 01:23.264
that I don't plan on manually statically configuring all

36
01:23.264 --> 01:25.740
these IP addresses on these four VMs as we bring them up.

37
01:25.740 --> 01:26.730
And that'll give us an opportunity

38
01:26.730 --> 01:29.760
to focus our attention here on the logical layer three

39
01:29.760 --> 01:31.080
routing inside of NSX.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:29.760 --> 01:31.080
routing inside of NSX.

40
01:31.080 --> 01:33.000
Also, to start off, we are gonna start off

41
01:33.000 --> 01:35.250
with our tier one gateway

42
01:35.250 --> 01:37.110
that'll provide the east-west routing.

43
01:37.110 --> 01:39.060
And then as we progress together,

44
01:39.060 --> 01:41.280
we'll have a separate skill on integrating

45
01:41.280 --> 01:44.100
and adding on top of that a tier zero router,

46
01:44.100 --> 01:46.170
which connects as a gateway to the outside world.

47
01:46.170 --> 01:47.460
So as part of our game plan,

48
01:47.460 --> 01:51.150
segment 10 is gonna have addressing space of 10.10.0.0

49
01:51.150 --> 01:52.770
with a slash 24,

50
01:52.770 --> 01:54.840
and segment 20 is gonna have the

51
01:54.840 --> 01:57.840
IP addressing space of 10.20.0.0

52
01:57.840 --> 01:59.220
with a slash 24.

53
01:59.220 --> 02:01.980
And then for this logical layer three router,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:59.220 --> 02:01.980
And then for this logical layer three router,

54
02:01.980 --> 02:05.070
which we are gonna implement as a gateway in NSX,

55
02:05.070 --> 02:07.590
let's go ahead and use dot one right here

56
02:07.590 --> 02:09.630
on the 10, 10, 0 network for that connection,

57
02:09.630 --> 02:10.740
for that interface.

58
02:10.740 --> 02:12.900
And then we'll use dot two right here

59
02:12.900 --> 02:16.380
for the connection from this gateway to this segment.

60
02:16.380 --> 02:18.360
And that way this logical layer three router,

61
02:18.360 --> 02:20.700
which is gonna be a distributed router to begin with,

62
02:20.700 --> 02:23.250
it can do the logical routing between those two segments.

63
02:23.250 --> 02:24.750
Now, behind the scenes,

64
02:24.750 --> 02:26.940
what's gonna happen when we implement this is

65
02:26.940 --> 02:29.809
that over here on ESXI-A, NSX,

66
02:29.809 --> 02:31.440
the NSX manager is gonna replicate
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:29.809 --> 02:31.440
the NSX manager is gonna replicate

67
02:31.440 --> 02:34.740
that information about this logical layer three router,

68
02:34.740 --> 02:37.651
and it's gonna replicate that to ESXI transport nodes,

69
02:37.651 --> 02:40.920
which in this case would be ESXI-A as a host transport node,

70
02:40.920 --> 02:44.190
and also ESXI-B as a host transport node,

71
02:44.190 --> 02:46.800
ESXI-A has a VM on both segments

72
02:46.800 --> 02:49.590
and ESXI-B has a VM on both segments.

73
02:49.590 --> 02:51.720
And as a result, each of those transport nodes,

74
02:51.720 --> 02:54.330
these Host Transport Nodes, are gonna have effectively a

75
02:54.330 --> 02:57.870
copy or an instance of that distributed router.

76
02:57.870 --> 03:00.120
So either one of them can make routing decisions
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

76
02:57.870 --> 03:00.120
So either one of them can make routing decisions

77
03:00.120 --> 03:02.340
between segment 10 and segment 20.

78
03:02.340 --> 03:04.890
And then after the layer three routing decision is made,

79
03:04.890 --> 03:07.140
then regarding the destination layer two address,

80
03:07.140 --> 03:09.240
if it's not local, for example, we have this machine here,

81
03:09.240 --> 03:11.970
Host-A VM on segment 10 needs to communicate

82
03:11.970 --> 03:15.810
with this VM over here, Host-B VM segment 20,

83
03:15.810 --> 03:18.060
Host-A would make their routing decision first

84
03:18.060 --> 03:20.250
between segment 10 and segment 20.

85
03:20.250 --> 03:21.570
And then when it looks for the destination

86
03:21.570 --> 03:23.370
layer two address, it would identify, oh,

87
03:23.370 --> 03:26.310
that layer two address is reachable on a VM

88
03:26.310 --> 03:28.200
that's over on ESXI-B,

89
03:28.200 --> 03:31.050
at which point Host-A would then use the Geneve tunnel
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
03:28.200 --> 03:31.050
at which point Host-A would then use the Geneve tunnel

90
03:31.050 --> 03:32.190
to go ahead and encapsulate

91
03:32.190 --> 03:35.160
and forward the traffic to the destination

92
03:35.160 --> 03:36.870
of the Host-B VM right here.

93
03:36.870 --> 03:38.490
And as part of that tunnel on the Geneve header,

94
03:38.490 --> 03:40.770
it's gonna indicate that the destination segment,

95
03:40.770 --> 03:43.170
that this frame of data that's being encapsulated

96
03:43.170 --> 03:45.840
belongs to, is associated with segment 20.

97
03:45.840 --> 03:47.940
So the ESXI-B can de-encapsulate

98
03:47.940 --> 03:49.890
and then make the forwarding decision over here

99
03:49.890 --> 03:51.780
to this VM at that MAC address.

100
03:51.780 --> 03:54.240
So once we validate our existing infrastructure,

101
03:54.240 --> 03:56.370
which currently just has two segments

102
03:56.370 --> 03:58.770
and no logical layer three routing between them,

103
03:58.770 --> 04:00.420
then our next step would be to go ahead
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
03:58.770 --> 04:00.420
then our next step would be to go ahead

104
04:00.420 --> 04:02.910
and create the tier one gateway.

105
04:02.910 --> 04:04.260
Now, when we create that gateway

106
04:04.260 --> 04:06.510
that can do our east-west routing between our,

107
04:06.510 --> 04:08.790
in our example, segment 10 and segment 20,

108
04:08.790 --> 04:10.770
there are a couple options when we deploy this.

109
04:10.770 --> 04:13.620
And one of those options is when we create that gateway

110
04:13.620 --> 04:17.430
to say that we want it to be a distributed router only.

111
04:17.430 --> 04:19.170
Now, if we say that, that just simply means

112
04:19.170 --> 04:22.140
that the ESXI hosts that have VMs that are connected

113
04:22.140 --> 04:24.030
to the segments, they're gonna have a copy of

114
04:24.030 --> 04:27.690
that logical layer three router locally on them,

115
04:27.690 --> 04:29.100
so they can make the routing decisions

116
04:29.100 --> 04:30.840
and then forward to the other host where
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
04:29.100 --> 04:30.840
and then forward to the other host where

117
04:30.840 --> 04:33.720
that host has the VM that's the final destination

118
04:33.720 --> 04:34.553
of the traffic.

119
04:34.553 --> 04:36.870
Now, we also mentioned that the reason

120
04:36.870 --> 04:39.780
that we deploy the Edge Transport Nodes,

121
04:39.780 --> 04:43.920
as I have listed up here, is to provide additional logical

122
04:43.920 --> 04:45.450
functions and services.

123
04:45.450 --> 04:46.890
However, I wanna also point out

124
04:46.890 --> 04:50.250
that these Edge Nodes are not absolutely required

125
04:50.250 --> 04:52.170
for every possible option.

126
04:52.170 --> 04:55.230
So, if we simply wanna have our host transport nodes working

127
04:55.230 --> 04:56.820
in this topology right here,

128
04:56.820 --> 04:59.148
with a logical layer three router routing between segment 10

129
04:59.148 --> 05:01.031
and segment 20, which effectively is routing
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

129
04:59.148 --> 05:01.031
and segment 20, which effectively is routing

130
05:01.031 --> 05:03.240
between the 10, 10, 0 network,

131
05:03.240 --> 05:05.970
and the 10, 20, 0 network, when we deploy the gateway,

132
05:05.970 --> 05:09.250
if we specify distributed router only, it's not going

133
05:09.250 --> 05:13.560
to involve the Edge Transport Nodes, which acting

134
05:13.560 --> 05:14.760
as a cluster edge.

135
05:14.760 --> 05:16.440
So even though they are there,

136
05:16.440 --> 05:19.727
if we say we want this T-one logical gateway

137
05:19.727 --> 05:22.689
as a distributed router only, there's no need

138
05:22.689 --> 05:26.580
to actually include Edge one and Edge two in that equation,

139
05:26.580 --> 05:29.070
because these two hosts will have a copy of

140
05:29.070 --> 05:30.330
that distributed router
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

140
05:29.070 --> 05:30.330
that distributed router

141
05:30.330 --> 05:31.830
and they can make the routing decisions

142
05:31.830 --> 05:33.300
and forward traffic back and forth.

143
05:33.300 --> 05:36.480
However, if we wanna use additional services, for example,

144
05:36.480 --> 05:39.240
if we want to include services like NAT,

145
05:39.240 --> 05:43.170
network address translation, or have a DHCP server,

146
05:43.170 --> 05:45.180
or set up VPNs,

147
05:45.180 --> 05:48.150
or have some Stateful firewall functionality at a gateway,

148
05:48.150 --> 05:51.270
at that point, we are gonna be using the actual services

149
05:51.270 --> 05:54.930
of the Edge Nodes that are providing those functions.

150
05:54.930 --> 05:57.300
And when we start using these types of network services,

151
05:57.300 --> 06:00.840
there's another instance of routing that's implemented,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

151
05:57.300 --> 06:00.840
there's another instance of routing that's implemented,

152
06:00.840 --> 06:02.220
and that is called a services router,

153
06:02.220 --> 06:04.680
which we're gonna cover more in a separate skill.

154
06:04.680 --> 06:05.880
So for now, just realize

155
06:05.880 --> 06:07.890
that a distributed router, like the basic nuts

156
06:07.890 --> 06:09.390
and bolts of routing packets,

157
06:09.390 --> 06:13.320
and a distributed router can exist on host transport nodes,

158
06:13.320 --> 06:16.170
it can also exist on Edge Nodes when it's needed,

159
06:16.170 --> 06:18.150
meaning these Edge Nodes are involved in

160
06:18.150 --> 06:19.410
the routing process.

161
06:19.410 --> 06:21.990
And when we begin to incorporate additional services such

162
06:21.990 --> 06:24.750
as network address translation or VPNs,

163
06:24.750 --> 06:26.220
or if we want some fault tolerance,

164
06:26.220 --> 06:29.070
maybe we wanna implement these Edge Transport Nodes

165
06:29.070 --> 06:32.190
and provide active standby services so that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

165
06:29.070 --> 06:32.190
and provide active standby services so that

166
06:32.190 --> 06:34.830
with the cluster, with these two Edge Nodes running, if one

167
06:34.830 --> 06:37.020
of them fails, the other one can pick up the slack.

168
06:37.020 --> 06:38.640
So we do set up additional services

169
06:38.640 --> 06:41.160
that do require the services of these Edge Nodes,

170
06:41.160 --> 06:43.800
at that point, NSX behind the scenes will

171
06:43.800 --> 06:45.750
automatically effectively turn on

172
06:45.750 --> 06:48.780
the services router function on those Edge Nodes.

173
06:48.780 --> 06:50.250
So at that point, our Edge Nodes

174
06:50.250 --> 06:51.810
if they're involved in the party as well,

175
06:51.810 --> 06:54.330
they would also have a copy of the distributed router,

176
06:54.330 --> 06:56.280
but they would also have a copy when needed

177
06:56.280 --> 06:57.840
of a services router.

178
06:57.840 --> 06:59.700
And that is what allows them to do the services

179
06:59.700 --> 07:01.560
of things like NAT and VPN
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

179
06:59.700 --> 07:01.560
of things like NAT and VPN

180
07:01.560 --> 07:04.530
and connectivity to outside resources like the outside world

181
07:04.530 --> 07:06.630
or to a service provider and so forth.

182
07:06.630 --> 07:09.690
And because it's gonna be super helpful in seeing this all

183
07:09.690 --> 07:11.460
grow step-by-step, I'm going

184
07:11.460 --> 07:15.630
to intentionally not engage those services up here on the

185
07:15.630 --> 07:16.530
Edge Nodes,

186
07:16.530 --> 07:17.910
like NAT

187
07:17.910 --> 07:19.410
or VPNs

188
07:19.410 --> 07:23.010
or Active Standby Services for the logical routing

189
07:23.010 --> 07:25.680
that would require these guys to get involved

190
07:25.680 --> 07:27.150
and actually do that work.

191
07:27.150 --> 07:29.730
Because if we do the setup of the gateway

192
07:29.730 --> 07:32.580
as just a distributed router and no additional services,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

192
07:29.730 --> 07:32.580
as just a distributed router and no additional services,

193
07:32.580 --> 07:33.870
we can still do the routing here

194
07:33.870 --> 07:35.310
between these two segments,

195
07:35.310 --> 07:38.370
but it's all just in the minds of these ESXI hosts

196
07:38.370 --> 07:40.770
and their willingness to use the Geneve tunnel

197
07:40.770 --> 07:43.170
to forward traffic back and forth, for the benefit

198
07:43.170 --> 07:45.300
of one VM being able to talk to the other.

199
07:45.300 --> 07:47.310
So as part of our game plan, as we create

200
07:47.310 --> 07:49.830
that tier one gateway, I'm gonna set it up

201
07:49.830 --> 07:51.840
as a distributed router only,

202
07:51.840 --> 07:54.000
and we can focus on the traffic flows, the logic,

203
07:54.000 --> 07:55.920
and the routing with a distributed router.

204
07:55.920 --> 07:57.840
And then as we continue our journey together

205
07:57.840 --> 08:01.170
and we incorporate additional services like NAT
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

205
07:57.840 --> 08:01.170
and we incorporate additional services like NAT

206
08:01.170 --> 08:03.090
and connectivity to the outside world,

207
08:03.090 --> 08:06.000
and as a result, we'll then engage these Edge VMs

208
08:06.000 --> 08:09.210
who are in our Edge cluster to provide those services.

209
08:09.210 --> 08:12.150
And as a result on those Edge devices will then have a

210
08:12.150 --> 08:14.146
distributed router, just like the host transport nodes

211
08:14.146 --> 08:16.710
that have VMs on those segments.

212
08:16.710 --> 08:19.770
But in addition, the Edge Transport Nodes will also have a

213
08:19.770 --> 08:22.110
Services Router, we'll call it SR for short,

214
08:22.110 --> 08:24.990
which is just the logical entity on those edge nodes

215
08:24.990 --> 08:27.090
that are providing those additional network services.

216
08:27.090 --> 08:28.890
Alright, so to conclude with our game plan,

217
08:28.890 --> 08:30.810
we are gonna validate our topology.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

217
08:28.890 --> 08:30.810
we are gonna validate our topology.

218
08:30.810 --> 08:33.990
We're gonna create this tier one level gateway, right here,

219
08:33.990 --> 08:36.090
we'll call it tier one gateway A.

220
08:36.090 --> 08:37.197
And then we'll connect segment 10

221
08:37.197 --> 08:40.650
and segment 22, that logical router, we'll give each

222
08:40.650 --> 08:44.130
of those segments of appropriate IP address on the gateway,

223
08:44.130 --> 08:45.840
and then we'll verify that it works

224
08:45.840 --> 08:47.490
and we'll also walk through the logical

225
08:47.490 --> 08:48.750
routing that happens.

226
08:48.750 --> 08:51.270
And then we'll verify our connectivity both

227
08:51.270 --> 08:53.700
for VMs in the same segment on different hosts,

228
08:53.700 --> 08:56.310
and also for two VMs on two different segments,

229
08:56.310 --> 08:59.250
but happen to be hosted by the same host transport node

230
08:59.250 --> 09:02.130
where this host transport node can do that routing
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

230
08:59.250 --> 09:02.130
where this host transport node can do that routing

231
09:02.130 --> 09:05.310
between those two VMs on those two segments in its brain,

232
09:05.310 --> 09:07.110
inside of the hypervisor itself.

233
09:07.110 --> 09:08.550
It's also important to point out

234
09:08.550 --> 09:11.250
that if we do set up the DHCP services, which I'm going

235
09:11.250 --> 09:13.350
to do here for these segments,

236
09:13.350 --> 09:15.990
because the DHCP is a network service that's

237
09:15.990 --> 09:18.630
provided by our Edge Nodes, we are gonna have a little bit

238
09:18.630 --> 09:21.600
of services router functionality at the Edge Nodes,

239
09:21.600 --> 09:23.940
but it's just gonna be to support the DHCP services.

240
09:23.940 --> 09:26.460
And when we set up this gateway function by itself,

241
09:26.460 --> 09:29.370
we'll tell it we just want a distributed router

242
09:29.370 --> 09:30.840
and we don't want active standby.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

242
09:29.370 --> 09:30.840
and we don't want active standby.

243
09:30.840 --> 09:32.340
So for the DHCP services,

244
09:32.340 --> 09:35.740
I'm gonna set up a logical DHCP server at 99.99.99

245
09:37.740 --> 09:38.790
so that way when you see that,

246
09:38.790 --> 09:39.817
you'll know exactly what it is.

247
09:39.817 --> 09:42.150
"Oh, that's the DHCP server that Keith set up".

248
09:42.150 --> 09:44.280
And then for some implementations, it's gonna ask us

249
09:44.280 --> 09:47.010
for an IP address on each of the subnets

250
09:47.010 --> 09:48.600
for the DHCP services.

251
09:48.600 --> 09:51.180
So when that happens, I'm gonna use dot two.

252
09:51.180 --> 09:54.240
So over here it'd be 10, 10, 02 for the DHCP server.

253
09:54.240 --> 09:56.400
Over here, it's 10, 20, 02.

254
09:56.400 --> 09:57.390
And again, there's a few options

255
09:57.390 --> 09:58.950
for implementing DHCP services.

256
09:58.950 --> 10:00.300
And the reason I just mentioned that is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

256
09:58.950 --> 10:00.300
And the reason I just mentioned that is

257
10:00.300 --> 10:03.540
because when you see either 10, 10, 02

258
10:03.540 --> 10:06.930
or you see 99, 99, et cetera, just be aware that that's

259
10:06.930 --> 10:09.150
for the DHCP services that I've got set up

260
10:09.150 --> 10:09.983
in the background.

261
10:09.983 --> 10:12.780
And again, we'll have a whole separate skill on the details

262
10:12.780 --> 10:15.300
and the flow and setup of DHCP.

263
10:15.300 --> 10:17.640
But for now, I just want the DHCP functionality

264
10:17.640 --> 10:20.280
and I don't want you to have any surprises about the dot 2

265
10:20.280 --> 10:22.740
address or the 99 address space there.

266
10:22.740 --> 10:25.440
Just realize it's all related to DHCP services

267
10:25.440 --> 10:26.493
for our topology.