WEBVTT

1
00:00.210 --> 00:02.280
So now that this is all in place,

2
00:02.280 --> 00:03.690
and all of our devices,

3
00:03.690 --> 00:06.870
including these two ESXi host transport nodes

4
00:06.870 --> 00:08.220
and these edge transport nodes,

5
00:08.220 --> 00:11.280
they all know about the logical Layer 3 routing,

6
00:11.280 --> 00:13.050
they have copies of, effectively,

7
00:13.050 --> 00:16.290
each of the logical routers, tier-0 gateway-0,

8
00:16.290 --> 00:18.600
tier-1 gateway-A, and tier-2 gateway-B.

9
00:18.600 --> 00:20.220
We should, as long as the clients

10
00:20.220 --> 00:22.050
have a correct IP address on the subnets

11
00:22.050 --> 00:23.880
and they have a correct default gateway

12
00:23.880 --> 00:25.770
using .1 on their local subnets

13
00:25.770 --> 00:26.970
for the default gateway function

14
00:26.970 --> 00:29.370
which is associated with our tier-1 gateways,

15
00:29.370 --> 00:30.840
the traffic should be able to be routed
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.370 --> 00:30.840
the traffic should be able to be routed

16
00:30.840 --> 00:32.550
between these two segments,

17
00:32.550 --> 00:35.190
whether it's done logically in the mind of an ESXi host

18
00:35.190 --> 00:37.230
that has both VMs or whether or not

19
00:37.230 --> 00:38.640
we're making a routing decision

20
00:38.640 --> 00:40.830
before forwarding that traffic across the network.

21
00:40.830 --> 00:42.060
So just as a quick test,

22
00:42.060 --> 00:44.850
let's go ahead and verify basic connectivity

23
00:44.850 --> 00:48.300
between VM-1 here and VM-2,

24
00:48.300 --> 00:50.790
and that'd be routed locally here on ESXi-A,

25
00:50.790 --> 00:54.630
let's also test connectivity from VM-1 one over to VM-4,

26
00:54.630 --> 00:56.400
which, once again, the routing decision

27
00:56.400 --> 00:59.070
would be made here on ESXi-A

28
00:59.070 --> 01:01.320
and then forwarded over the Geneve tunnel
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:59.070 --> 01:01.320
and then forwarded over the Geneve tunnel

29
01:01.320 --> 01:04.800
over to ESXi-B which has responsibility for VM-4

30
01:04.800 --> 01:06.600
and its Layer 2 mac address.

31
01:06.600 --> 01:09.690
Let's do an ifconfig real quick, to verify our IP address.

32
01:09.690 --> 01:12.420
So my IP address here is 10.10.0.10,

33
01:12.420 --> 01:14.550
and again, this is on VM-1.

34
01:14.550 --> 01:17.790
And let's do a test with a ping to 10.20.0.20,

35
01:17.790 --> 01:21.450
press Enter, and that is working, fantastic.

36
01:21.450 --> 01:23.250
So we'll do a CTRL-C to stop that,

37
01:23.250 --> 01:25.950
and let's also do a ping from VM-1,

38
01:25.950 --> 01:27.330
and let's go over to VM-4.

39
01:27.330 --> 01:28.710
So just as a confirmation,

40
01:28.710 --> 01:31.590
VM-4 is right here at 10.20.0.21.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:28.710 --> 01:31.590
VM-4 is right here at 10.20.0.21.

41
01:31.590 --> 01:32.790
So for that ping test, let me go ahead

42
01:32.790 --> 01:35.430
and bring back in my command lane interface,

43
01:35.430 --> 01:36.300
and it's a little bit small,

44
01:36.300 --> 01:38.430
but I'm sitting here at VM-1 still

45
01:38.430 --> 01:41.370
and we're gonna do a ping over to 10.20.0.21.

46
01:41.370 --> 01:46.170
So we'll do a ping over to 10.20.0.21, press Enter,

47
01:46.170 --> 01:48.780
and sure enough, that is working great too.

48
01:48.780 --> 01:51.360
So we'll do a CTRL-C, and let me move that CLI

49
01:51.360 --> 01:53.640
outta the way, just for a moment, for that little VM.

50
01:53.640 --> 01:56.670
So if we were going to predict the traffic flows here,

51
01:56.670 --> 01:58.290
here's what we would predict for the traffic

52
01:58.290 --> 01:59.730
from VM-1 to VM-2,

53
01:59.730 --> 02:03.060
and that traffic would be sourced from VM-1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:59.730 --> 02:03.060
and that traffic would be sourced from VM-1.

54
02:03.060 --> 02:05.490
And we could also confirm the traffic flow

55
02:05.490 --> 02:06.840
and the logical routing decisions

56
02:06.840 --> 02:10.440
that are being made by going to Traceflow in NSX Manager.

57
02:10.440 --> 02:12.330
So what we'd expect here on VM-1

58
02:12.330 --> 02:14.100
if it was trying to ping, for example, VM-2,

59
02:14.100 --> 02:17.310
is that traffic would be entering via this logical segment,

60
02:17.310 --> 02:18.570
called segment 10,

61
02:18.570 --> 02:20.250
and then host A with the distributed router

62
02:20.250 --> 02:22.860
would make the routing decision on the gateway

63
02:22.860 --> 02:24.090
to forward that to the next top,

64
02:24.090 --> 02:25.860
in this case would be tier-0,

65
02:25.860 --> 02:27.780
and then tier-0, because we're sharing these routes

66
02:27.780 --> 02:29.910
and advertising them up, tier-0 would say,

67
02:29.910 --> 02:31.860
oh, to get to the 10.20 address base,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:29.910 --> 02:31.860
oh, to get to the 10.20 address base,

68
02:31.860 --> 02:34.470
I'm gonna forward it down to gateway-B,

69
02:34.470 --> 02:37.710
and because VM-1 and VM-2 are both hosted on ESXi-A,

70
02:37.710 --> 02:40.710
all that logical routing is gonna happen in the brains here,

71
02:40.710 --> 02:41.940
or in the memory if you will,

72
02:41.940 --> 02:44.580
of ESXi transport host number A.

73
02:44.580 --> 02:48.120
And if we are sending traffic from VM-1 over to VM-4,

74
02:48.120 --> 02:52.050
the local routing decision from gateway-A, to tier-0,

75
02:52.050 --> 02:54.210
to gateway-B, would also be done in the brains here

76
02:54.210 --> 02:55.350
of ESXi-A.

77
02:55.350 --> 02:56.760
So after making the routing decision

78
02:56.760 --> 02:59.520
locally here at ESXi-A, it would forward the traffic

79
02:59.520 --> 03:01.260
over the tunnel to host B
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
02:59.520 --> 03:01.260
over the tunnel to host B

80
03:01.260 --> 03:04.410
where the Layer 2 address lives for VM-4,

81
03:04.410 --> 03:06.759
at which point ESXi-B would deencapsulate

82
03:06.759 --> 03:09.180
and then forward the traffic up to VM-4.

83
03:09.180 --> 03:11.340
And we can verify all those decisions

84
03:11.340 --> 03:14.490
and that traffic pattern simply by going to Traceflow

85
03:14.490 --> 03:17.730
inside of the NSX Manager, so let's do that right now,

86
03:17.730 --> 03:18.690
just to confirm.

87
03:18.690 --> 03:20.460
So here in the NSX Manager,

88
03:20.460 --> 03:22.770
let's go ahead and exit out of this topology view

89
03:22.770 --> 03:25.710
and let's make a road trip over to Plan and Troubleshoot,

90
03:25.710 --> 03:28.680
and that's where we're gonna find, under Traffic Analysis,

91
03:28.680 --> 03:30.090
that's where we're gonna find Traceflow.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
03:28.680 --> 03:30.090
that's where we're gonna find Traceflow.

92
03:30.090 --> 03:32.580
So let's click on get started with Traceflow

93
03:32.580 --> 03:33.960
and then, for the first test,

94
03:33.960 --> 03:36.270
we'll do it from VM-1,

95
03:36.270 --> 03:38.760
and it's showing us the details about VM-1

96
03:38.760 --> 03:41.190
with its IP address, and Layer 2 address, and so forth,

97
03:41.190 --> 03:43.080
and the first test is gonna be over to VM-2,

98
03:43.080 --> 03:45.270
which is also hosted by ESXi-A.

99
03:45.270 --> 03:46.770
So we'll select VM-2,

100
03:46.770 --> 03:49.320
and we'll confirm its IP address as well, that looks great.

101
03:49.320 --> 03:51.330
So traffic is coming from 10.10.0.10,

102
03:51.330 --> 03:53.250
going over to 10.20.0.20,

103
03:53.250 --> 03:55.920
that's VM-1 and VM-2's addresses respectively,

104
03:55.920 --> 03:57.240
and we'll click on Trace.

105
03:57.240 --> 04:00.510
And what we're expecting to see is a full routing decision,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

105
03:57.240 --> 04:00.510
And what we're expecting to see is a full routing decision,

106
04:00.510 --> 04:04.770
routing flow, that starts here at VM-1, goes to gateway-A,

107
04:04.770 --> 04:08.190
then tier-0, then gateway-B, then down to segment 20,

108
04:08.190 --> 04:09.570
then to VM-2.

109
04:09.570 --> 04:12.420
And even though it's being hosted by one ESXi host,

110
04:12.420 --> 04:14.670
we're still expecting to see all that logic happening,

111
04:14.670 --> 04:17.250
and because these two VMs are on the same ESXi host,

112
04:17.250 --> 04:18.750
it's gonna be ESXi-A,

113
04:18.750 --> 04:21.750
with its three distributed routers that it has,

114
04:21.750 --> 04:23.940
that's gonna be making all those routing decisions,

115
04:23.940 --> 04:25.620
effectively, in its brain.

116
04:25.620 --> 04:27.510
So to verify that, let me go ahead

117
04:27.510 --> 04:31.050
and bring this full screen and make it a little bit bigger,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
04:27.510 --> 04:31.050
and bring this full screen and make it a little bit bigger,

118
04:31.050 --> 04:31.883
and here we go.

119
04:31.883 --> 04:34.260
So the traffic starting here at VM-1

120
04:34.260 --> 04:36.060
went in through the yellow segment,

121
04:36.060 --> 04:37.560
it went through the gateway-A,

122
04:37.560 --> 04:40.710
got routed through gateway-0, then through gateway-B,

123
04:40.710 --> 04:42.330
then down through the pink segment here

124
04:42.330 --> 04:44.940
where it was finally delivered to the final destination.

125
04:44.940 --> 04:48.270
And if we clicked on the host icon on the left or right

126
04:48.270 --> 04:49.620
for any of these steps,

127
04:49.620 --> 04:51.990
it's all gonna reflect its ESXi-A.

128
04:51.990 --> 04:55.320
So, right here it shows that's ESXi-A doing the work,

129
04:55.320 --> 04:57.840
and if we go over here to the far right, for example,

130
04:57.840 --> 05:00.960
down to our tier-1 gateway-B, and click on the host,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

130
04:57.840 --> 05:00.960
down to our tier-1 gateway-B, and click on the host,

131
05:00.960 --> 05:03.720
it's gonna show, once again, it's ESXi-A,

132
05:03.720 --> 05:07.620
and the final VM, because it also is hosted on ESXi-A,

133
05:07.620 --> 05:09.660
that's gonna be on ESXi-A as well.

134
05:09.660 --> 05:12.960
So all of this logical Layer 3 routing of the packets

135
05:12.960 --> 05:15.900
were all done in the brains of ESXi-A,

136
05:15.900 --> 05:18.210
and if we collapse that and make it a little smaller,

137
05:18.210 --> 05:20.670
it also shows us the details right here,

138
05:20.670 --> 05:22.110
how it came into the network,

139
05:22.110 --> 05:24.300
the logical firewalls that it went through,

140
05:24.300 --> 05:27.720
the segments it went through, the gateway-A it went through,

141
05:27.720 --> 05:29.670
the logical routing through the transit network

142
05:29.670 --> 05:31.890
from gateway-A to gateway-0,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
05:29.670 --> 05:31.890
from gateway-A to gateway-0,

143
05:31.890 --> 05:33.330
where gateway-0 received it,

144
05:33.330 --> 05:35.310
logically sent it through the transit network

145
05:35.310 --> 05:38.040
between it and gateway-B, where gateway-B received it,

146
05:38.040 --> 05:40.080
and then it went through the segment 20,

147
05:40.080 --> 05:41.700
went through a logical distributed firewall,

148
05:41.700 --> 05:43.830
which, by default, was permitting everything,

149
05:43.830 --> 05:45.780
and then finally being delivered to VM-2,

150
05:45.780 --> 05:47.730
who is also being hosted on ESXi-A.

151
05:47.730 --> 05:51.240
So across the board, the transport node mold was all ESXi-A.

152
05:51.240 --> 05:53.130
So if we did a new trace,

153
05:53.130 --> 05:55.050
and I'll click on Proceed for new trace,

154
05:55.050 --> 05:58.170
and we went from VM-1 to VM-4,

155
05:58.170 --> 06:00.120
in this case the closest transport node
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

155
05:58.170 --> 06:00.120
in this case the closest transport node

156
06:00.120 --> 06:03.330
to make those routing decisions for VM-1 is ESXi-A.

157
06:03.330 --> 06:07.560
So, if we're sending traffic from VM-1 over to VM-4,

158
06:07.560 --> 06:10.950
the logical flow would be from the VM, to gateway-A,

159
06:10.950 --> 06:13.080
to tier-0, to gateway-B,

160
06:13.080 --> 06:15.060
and then being delivered down to VM-4.

161
06:15.060 --> 06:17.820
However, the routing decisions for gateway-A, and tier-0,

162
06:17.820 --> 06:19.920
and gateway-B, all that routing is done

163
06:19.920 --> 06:21.780
closest to the source, in this case VM-1,

164
06:21.780 --> 06:24.990
so ESXi-A is gonna make all those routing decisions.

165
06:24.990 --> 06:27.240
And then once it figures out it's on segment 20,

166
06:27.240 --> 06:28.710
and also then further figures out

167
06:28.710 --> 06:31.230
that the Layer 2 address for VM-4 is over a tunnel
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

167
06:28.710 --> 06:31.230
that the Layer 2 address for VM-4 is over a tunnel

168
06:31.230 --> 06:34.230
over to ESXi-B, it'll then encapsulate,

169
06:34.230 --> 06:36.390
send it over the Geneve tunnel to ESXi-B,

170
06:36.390 --> 06:37.500
who will then deencapsulate

171
06:37.500 --> 06:39.030
and forward it to the final destination.

172
06:39.030 --> 06:42.270
And again, a Traceflow can verify that for us as well.

173
06:42.270 --> 06:43.830
So here, back in our Traceflow,

174
06:43.830 --> 06:46.290
we're gonna select the source as VM-1,

175
06:46.290 --> 06:48.150
confirm its IP address, fantastic,

176
06:48.150 --> 06:50.700
and the destination is gonna be VM-4,

177
06:50.700 --> 06:52.770
so we'll confirm that IP address as well.

178
06:52.770 --> 06:54.990
That all looks good, and we'll click on Trace,

179
06:54.990 --> 06:56.910
and we'll give that a minute to cook.

180
06:56.910 --> 06:59.340
So let's take a look at the full screen view here,

181
06:59.340 --> 07:02.160
and there's our traffic flow from VM-1,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

181
06:59.340 --> 07:02.160
and there's our traffic flow from VM-1,

182
07:02.160 --> 07:04.470
up to the segment, through three routers,

183
07:04.470 --> 07:05.790
down through segment 20,

184
07:05.790 --> 07:07.950
and down to the final target VM-4.

185
07:07.950 --> 07:10.230
And so if we clicked on the host information here,

186
07:10.230 --> 07:12.870
for example, the logical gateway-A routing function,

187
07:12.870 --> 07:15.690
if we click here on the host, that's gonna be ESXi-A.

188
07:15.690 --> 07:17.970
And if we looked at the gateway-0 routing decision

189
07:17.970 --> 07:20.670
and clicked on the host there, also gateway-A.

190
07:20.670 --> 07:21.690
If we clicked on the host

191
07:21.690 --> 07:24.180
associated with this router right here, gateway-B,

192
07:24.180 --> 07:27.207
so we'll click on the host icon, once again ESXi-A.

193
07:27.207 --> 07:29.640
And then once more, for the connection to the pink segment,

194
07:29.640 --> 07:32.040
if we click here, once again ESXi-A.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

194
07:29.640 --> 07:32.040
if we click here, once again ESXi-A.

195
07:32.040 --> 07:33.990
But, at this point right here,

196
07:33.990 --> 07:36.690
between the logical segment 20

197
07:36.690 --> 07:38.490
and where the actual VM lives,

198
07:38.490 --> 07:39.600
it was sent through the tunnel,

199
07:39.600 --> 07:41.433
so if we click on this last device here,

200
07:41.433 --> 07:45.720
it's gonna be ESXi-B, which is the host supporting VM-4.

201
07:45.720 --> 07:47.220
So to see the actual play by play,

202
07:47.220 --> 07:49.530
let's go ahead and exit full screen

203
07:49.530 --> 07:50.970
and I'll scroll up a little bit here

204
07:50.970 --> 07:52.230
so we can see the details,

205
07:52.230 --> 07:53.820
and this logically shows us the flow.

206
07:53.820 --> 07:55.710
So let's get down to the interesting part.

207
07:55.710 --> 07:57.120
So everything up to this point,

208
07:57.120 --> 07:59.490
everything above it was done, all the logical routing,

209
07:59.490 --> 08:00.750
was done by ESXi-A.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

209
07:59.490 --> 08:00.750
was done by ESXi-A.

210
08:00.750 --> 08:01.583
And at this point,

211
08:01.583 --> 08:03.870
we're sending the traffic encapsulated over the tunnel

212
08:03.870 --> 08:06.690
from our tunnel endpoint address at ESXi-A

213
08:06.690 --> 08:09.090
over the tunnel endpoint at ESXi-B,

214
08:09.090 --> 08:12.360
and the next entry here shows ESXi-B receiving that

215
08:12.360 --> 08:14.460
at its local endpoint of 22 et cetera,

216
08:14.460 --> 08:17.670
from the tunnel endpoint address of ESXi-A,

217
08:17.670 --> 08:18.810
and then we scroll down,

218
08:18.810 --> 08:20.520
it's logically going through a distributed firewall,

219
08:20.520 --> 08:22.350
which is permitting that traffic by default,

220
08:22.350 --> 08:23.910
and then delivering it to VM-4.

221
08:23.910 --> 08:25.050
And the key takeaways here,

222
08:25.050 --> 08:26.940
is that each of these transport nodes

223
08:26.940 --> 08:29.310
with a full complement of all the information

224
08:29.310 --> 08:31.980
for all three logical gateways,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

224
08:29.310 --> 08:31.980
for all three logical gateways,

225
08:31.980 --> 08:33.240
can make the routing decisions.

226
08:33.240 --> 08:36.390
And then, based on NSX and the control plane

227
08:36.390 --> 08:37.770
educating the transport nodes

228
08:37.770 --> 08:40.020
regarding Layer 2 addresses and how to reach them,

229
08:40.020 --> 08:42.570
once the routing decision is done close to the source,

230
08:42.570 --> 08:44.970
then that traffic can be forwarded to the appropriate node

231
08:44.970 --> 08:47.620
who can deliver the traffic to the final destination.