WEBVTT

1
00:00.240 --> 00:03.210
So now this logical layer 3 router

2
00:03.210 --> 00:07.230
exists locally as a distributed router here and here.

3
00:07.230 --> 00:08.400
And the benefit of that is

4
00:08.400 --> 00:11.550
that ESXi-A can now make routing decisions

5
00:11.550 --> 00:13.350
between those two segments.

6
00:13.350 --> 00:15.030
And then when needed it can go ahead

7
00:15.030 --> 00:17.910
and transport data over the tunnel over

8
00:17.910 --> 00:21.000
to a host like ESXi-B if the traffic was going,

9
00:21.000 --> 00:23.010
for example, from one of these two VMs

10
00:23.010 --> 00:24.300
over to one of these two VMs.

11
00:24.300 --> 00:26.520
So before we get to that verification of

12
00:26.520 --> 00:28.470
where the routing is done and how it's done,

13
00:28.470 --> 00:31.740
let's take a look at the actual distributed router function
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:28.470 --> 00:31.740
let's take a look at the actual distributed router function

14
00:31.740 --> 00:33.480
on each of these ESXi hosts,

15
00:33.480 --> 00:35.220
just to confirm that they both

16
00:35.220 --> 00:37.440
have exactly the same information

17
00:37.440 --> 00:39.870
about this logical layer 3 router.

18
00:39.870 --> 00:42.840
So I'm using SecureCRT as a terminal emulator.

19
00:42.840 --> 00:45.960
I just started two SSH sessions, one here on the left

20
00:45.960 --> 00:49.710
to ESXi-A and the other on the right to ESXi-B.

21
00:49.710 --> 00:52.830
So on each of them I'm gonna type in nsxcli

22
00:52.830 --> 00:55.860
to go into the NSX CLI for each one

23
00:55.860 --> 00:57.240
and then to give the same commands

24
00:57.240 --> 00:58.920
to both devices at the same time,

25
00:58.920 --> 01:00.900
I'm gonna use this command window down here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:58.920 --> 01:00.900
I'm gonna use this command window down here.

26
01:00.900 --> 01:02.910
I'm gonna right click and say, please send commands

27
01:02.910 --> 01:04.620
to all sessions.

28
01:04.620 --> 01:06.060
And that way they'll both get the same commands.

29
01:06.060 --> 01:08.760
So if we did a get logical routers,

30
01:08.760 --> 01:10.800
that's gonna show us the logical routers

31
01:10.800 --> 01:14.190
that exist on these two host transport notes.

32
01:14.190 --> 01:15.840
And you'll notice that the VDR,

33
01:15.840 --> 01:19.396
the virtual distributed router has the exact same UUID

34
01:19.396 --> 01:23.310
on both of 'em, same number of logical interfaces, 2,

35
01:23.310 --> 01:26.460
and that's the two logical interfaces, one connected

36
01:26.460 --> 01:28.980
to segment 10, the other connected to segment 20.

37
01:28.980 --> 01:30.750
And if we scroll to the right a little bit,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:28.980 --> 01:30.750
And if we scroll to the right a little bit,

38
01:30.750 --> 01:32.490
they also have the same number of routes.

39
01:32.490 --> 01:34.500
They have the route for the 10.10 network

40
01:34.500 --> 01:35.820
and the 10.20 network.

41
01:35.820 --> 01:37.110
And going forward, more

42
01:37.110 --> 01:38.370
and more of the commands in the world

43
01:38.370 --> 01:42.210
of NSX are being migrated over to the get gateways command

44
01:42.210 --> 01:44.070
as opposed to get logical routers.

45
01:44.070 --> 01:45.600
So lemme show you what that looks like as well

46
01:45.600 --> 01:48.000
with a get gateways and press enter.

47
01:48.000 --> 01:49.860
And you might say, well Keith, it's the same output.

48
01:49.860 --> 01:51.000
And yes it is.

49
01:51.000 --> 01:54.053
So if you're ever working with the NSX CLI, a lot

50
01:54.053 --> 01:55.719
of the older commands still work

51
01:55.719 --> 01:58.410
and they're migrating towards the newer options.

52
01:58.410 --> 02:01.440
So instead of saying, for example, logical switches,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:58.410 --> 02:01.440
So instead of saying, for example, logical switches,

53
02:01.440 --> 02:03.210
we can go ahead and say segments.

54
02:03.210 --> 02:05.940
Instead of saying logical routers, we can say gateways.

55
02:05.940 --> 02:08.400
So if we wanna find more information on this gateway,

56
02:08.400 --> 02:10.260
for example, hey, what are those interfaces

57
02:10.260 --> 02:12.360
that are connected or what routes do you have,

58
02:12.360 --> 02:16.740
we could use the command get and then gateway singular.

59
02:16.740 --> 02:19.920
And then we'll go ahead and specify the actual UUID

60
02:19.920 --> 02:21.120
and plug that in.

61
02:21.120 --> 02:23.130
And for contact sensitive help, I'm just gonna go

62
02:23.130 --> 02:25.138
to one window right here real quick and do a get

63
02:25.138 --> 02:26.940
and put in gateway.

64
02:26.940 --> 02:29.070
And then I'll put in the UUID space

65
02:29.070 --> 02:30.210
and a question mark just
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:29.070 --> 02:30.210
and a question mark just

66
02:30.210 --> 02:32.490
for context sensitive help about what the next options are.

67
02:32.490 --> 02:35.130
So we could collectively say we wanna look

68
02:35.130 --> 02:36.870
at the forwarding information

69
02:36.870 --> 02:38.970
that would include IPv4 and IPv6,

70
02:38.970 --> 02:41.100
or we could ask for forwarding information

71
02:41.100 --> 02:42.510
for a specific network.

72
02:42.510 --> 02:43.350
So let's do this.

73
02:43.350 --> 02:46.650
Let's go ahead and ask for forwarding information

74
02:46.650 --> 02:48.390
just for IPv4 routes.

75
02:48.390 --> 02:51.330
So right here we'll do get gateway, the UUID for

76
02:51.330 --> 02:54.660
that gateway, the keyword forwarding for that option.

77
02:54.660 --> 02:56.880
And then we'll follow it up with IPv4

78
02:56.880 --> 02:57.900
and press enter.

79
02:57.900 --> 03:00.870
And boom, here it's showing us the IPv4 routing table
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
02:57.900 --> 03:00.870
And boom, here it's showing us the IPv4 routing table

80
03:00.870 --> 03:02.130
for that distributed router.

81
03:02.130 --> 03:05.970
And it's the same on ESXi-A and ESXi-B.

82
03:05.970 --> 03:07.170
And if we scroll to the right, in fact,

83
03:07.170 --> 03:09.013
let me put these horizontal so I can see 'em side

84
03:09.013 --> 03:10.710
by side a little bit easier.

85
03:10.710 --> 03:12.990
So because the distributed router is the same

86
03:12.990 --> 03:14.550
and they both have a copy of it,

87
03:14.550 --> 03:16.200
it's showing us the two routes,

88
03:16.200 --> 03:17.790
the gateway associated with those networks.

89
03:17.790 --> 03:20.010
and the zeros here represents it's myself.

90
03:20.010 --> 03:23.190
This means that ESXi-A and ESXi-B

91
03:23.190 --> 03:25.980
because they both have clients VMs that are connected

92
03:25.980 --> 03:27.450
to those respective segments.

93
03:27.450 --> 03:30.570
They know how to reach those two logical networks.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
03:27.450 --> 03:30.570
They know how to reach those two logical networks.

94
03:30.570 --> 03:32.580
10.10.0 and 10.20.0 network.

95
03:32.580 --> 03:35.130
And then it has the interface ID for each

96
03:35.130 --> 03:37.016
of those interfaces on the distributed router

97
03:37.016 --> 03:38.610
to reach those networks.

98
03:38.610 --> 03:40.530
So if we did a get gateway, and I'm gonna go ahead

99
03:40.530 --> 03:43.680
and use that same UUID for the gateway

100
03:43.680 --> 03:45.454
and then we followed up with interfaces

101
03:45.454 --> 03:48.420
and press enter, it's gonna show us the interfaces

102
03:48.420 --> 03:51.540
associated with that logical distributed router.

103
03:51.540 --> 03:54.000
So I'm gonna go ahead and sort these side by side again

104
03:54.000 --> 03:56.070
to make it a little bit easier to read and compare.

105
03:56.070 --> 03:57.360
And let's scroll up.

106
03:57.360 --> 03:59.580
So there's the get gateway command

107
03:59.580 --> 04:01.560
and we're asking for the interfaces.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
03:59.580 --> 04:01.560
and we're asking for the interfaces.

108
04:01.560 --> 04:04.020
So here's the first interface, that's the LIF stands

109
04:04.020 --> 04:05.460
for logical interface.

110
04:05.460 --> 04:08.130
And there's the UUID for that specific interface.

111
04:08.130 --> 04:09.690
Here's the overlay of VNI

112
04:09.690 --> 04:12.510
and based on the IP address, this is for segment 20,

113
04:12.510 --> 04:14.010
and here's the default gateway.

114
04:14.010 --> 04:16.440
And you notice on both sides it's the same information

115
04:16.440 --> 04:18.600
because we're looking at the same distributed router.

116
04:18.600 --> 04:21.390
So if a client anywhere either ESXi-A

117
04:21.390 --> 04:24.300
or ESXi-B if they're on the 10.20.0 subnet,

118
04:24.300 --> 04:25.380
which is segment 20,

119
04:25.380 --> 04:27.900
and they do an ARP request for their default gateway,

120
04:27.900 --> 04:30.450
they're gonna get this information as their default gateway.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
04:27.900 --> 04:30.450
they're gonna get this information as their default gateway.

121
04:30.450 --> 04:32.190
So it doesn't matter where the client is,

122
04:32.190 --> 04:35.490
this virtualized Mac address that's being presented for them

123
04:35.490 --> 04:38.430
to use to reach their default gateway is gonna be the same

124
04:38.430 --> 04:41.250
on ESXi-A and ESXi-B.

125
04:41.250 --> 04:42.840
So if we brought up a client

126
04:42.840 --> 04:46.770
that was on the 10.20.0 network, that segment 20, just

127
04:46.770 --> 04:49.260
to verify for what it got as a result when

128
04:49.260 --> 04:52.170
for its default gateway layer two address, we could verify

129
04:52.170 --> 04:54.300
that it ends in 44:52, whether

130
04:54.300 --> 04:57.840
that VM is sitting on host A or host B.

131
04:57.840 --> 05:01.593
So here on VM-2 which is at 10.0.20,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
04:57.840 --> 05:01.593
So here on VM-2 which is at 10.0.20,

132
05:02.772 --> 05:04.140
if we do an ARP and take a look at the ARP cache,

133
05:04.140 --> 05:07.050
it currently does not have the layer 2 address

134
05:07.050 --> 05:08.010
of its default gateway.

135
05:08.010 --> 05:10.410
But let's send some traffic off the local network.

136
05:10.410 --> 05:13.620
Let's ping 10.10.0.10,

137
05:13.620 --> 05:15.270
that'll force traffic off the local network

138
05:15.270 --> 05:17.370
and as a result, it'll lead its default gateway.

139
05:17.370 --> 05:18.840
And now if we do a ARP

140
05:18.840 --> 05:20.720
and press enter, now we're showing the layer 2 address

141
05:20.720 --> 05:22.080
of the default gateway.

142
05:22.080 --> 05:26.040
And notice that that layer two address ends in 44:52.

143
05:26.040 --> 05:28.830
And if we were to do the same thing over on VM-4

144
05:28.830 --> 05:30.570
which is also on the 10.20 network,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

144
05:28.830 --> 05:30.570
which is also on the 10.20 network,

145
05:30.570 --> 05:33.150
it would also have the same layer 2 address associated

146
05:33.150 --> 05:36.150
with the default gateway at 10.20.0.1.

147
05:36.150 --> 05:39.360
So to verify that here we are at 10.20.21,

148
05:39.360 --> 05:40.950
we'll do an ARP press enter.

149
05:40.950 --> 05:42.420
It has nothing in its cache.

150
05:42.420 --> 05:44.670
So let's do a confirmation of it's IP address

151
05:44.670 --> 05:46.740
with an IF config, and let's go ahead

152
05:46.740 --> 05:48.120
and ping something off network.

153
05:48.120 --> 05:51.810
So we're at 10.20.0.21, let's ping 10.10.0.10.

154
05:51.810 --> 05:52.890
And that's great.

155
05:52.890 --> 05:54.750
So we would've used our default gateway for that.

156
05:54.750 --> 05:56.550
So now if we do an ARP and press enter,

157
05:56.550 --> 05:58.100
now we have the layer

158
05:58.100 --> 06:00.180
to address associated with our default gateway.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

158
05:58.100 --> 06:00.180
to address associated with our default gateway.

159
06:00.180 --> 06:03.484
And once again, it's the same exact layer to address

160
06:03.484 --> 06:06.540
for that same exact default gateway address.

161
06:06.540 --> 06:10.012
And that's because this distributed router on ESXi-A

162
06:10.012 --> 06:13.020
and ESXi-B, it exists on both.

163
06:13.020 --> 06:14.460
So if we go back to the output here,

164
06:14.460 --> 06:16.680
this is the first logical interface for

165
06:16.680 --> 06:18.090
that virtual router showing.

166
06:18.090 --> 06:20.370
And then the next one is right here.

167
06:20.370 --> 06:22.545
I'll line those up to make 'em really easy to see there.

168
06:22.545 --> 06:25.680
And that's the interface for the 10.10.0 network,

169
06:25.680 --> 06:27.660
which is the 10 segment.

170
06:27.660 --> 06:29.520
There's the VNI number for it.

171
06:29.520 --> 06:31.410
There's the default gateway address,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

171
06:29.520 --> 06:31.410
There's the default gateway address,

172
06:31.410 --> 06:33.930
and the corresponding layer 2 address

173
06:33.930 --> 06:36.480
that clients on those segments are gonna believe is

174
06:36.480 --> 06:38.670
associated with their default gateway.

175
06:38.670 --> 06:40.380
And that's what they'll use to forward frames

176
06:40.380 --> 06:41.610
to their default gateway.

177
06:41.610 --> 06:43.020
At which point the ESXi host

178
06:43.020 --> 06:45.930
who are hosting those VMs will be responding on behalf

179
06:45.930 --> 06:47.550
of those layer 2 addresses.

180
06:47.550 --> 06:49.126
And if we scroll up a little bit, notice that

181
06:49.126 --> 06:53.040
that Mac address is the same for both subnets.

182
06:53.040 --> 06:55.950
So it's using that Mac address for the layer two address

183
06:55.950 --> 06:58.650
of the default gateway on segment 20.

184
06:58.650 --> 07:01.800
It's also the same layer two Mac address associated
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

184
06:58.650 --> 07:01.800
It's also the same layer two Mac address associated

185
07:01.800 --> 07:04.380
with the default gateway here on segment 10.

186
07:04.380 --> 07:06.030
So at this point in the game, what do we know?

187
07:06.030 --> 07:08.880
Well, we know that this logical distributed router

188
07:08.880 --> 07:11.580
exists on this host transport node.

189
07:11.580 --> 07:14.220
It exists on this host transport node,

190
07:14.220 --> 07:15.810
and it's not necessarily gonna show up

191
07:15.810 --> 07:16.920
as a distributor router

192
07:16.920 --> 07:19.440
on every possible host transport node

193
07:19.440 --> 07:20.430
because we may have hosts

194
07:20.430 --> 07:22.200
that are supporting the same transport zones

195
07:22.200 --> 07:23.100
or the same segments.

196
07:23.100 --> 07:24.750
However, maybe we have a host out there

197
07:24.750 --> 07:27.750
that has zero VMs on any of those segments.

198
07:27.750 --> 07:30.450
And as a result, if we don't have any VMs on any segments,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

198
07:27.750 --> 07:30.450
And as a result, if we don't have any VMs on any segments,

199
07:30.450 --> 07:32.252
there's no need to have a distributed router

200
07:32.252 --> 07:33.660
on that respective host.

201
07:33.660 --> 07:36.090
But in our case, we have hosts on those segments

202
07:36.090 --> 07:39.210
on these two ESXi hosts, which are host transport nodes.

203
07:39.210 --> 07:40.585
And as a result, both of them

204
07:40.585 --> 07:44.343
have a real-time copy of that distributed router.