When we're talking about the data plane tunnels, we know that one when edge
device needs to communicate to another,
when edge device and form a tunnel, ideally an IPsec tunnel at the data plane.
And at that point, we are going to be able to send end user traffic through
that tunnel across whatever the circuit type is there in the middle.
Maybe it's MPLS or it could even be the internet.
But the question here is how exactly do we facilitate the creation of this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But the question here is how exactly do we facilitate the creation of this
tunnel?
For example, I need to know the IP address here of how to connect, but I also
need to know a lot of information about the other side.
If I'm coming from the perspective of the router on the left, I need to know
how to connect to this device, but importantly, I need to know information so I
can decide,
should I even form a tunnel? I mean, is a tunnel what we want to form
specifically to this device across this circuit? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
specifically to this device across this circuit?
And so this information is kind of interesting.
And what Cisco and SD-WAN solution does is it represents this information in
the form of a transport locator,
otherwise known as a T-lock.
This T-lock is interesting because it's actually what we call a three-tool of
information, meaning that we're going to pair up three different components to
form one identifier, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
form one identifier,
that we call the T-lock.
And so the three-tool consists, first of all, of a system IP.
And yes, the system IP is an IP address, but it's not necessarily going to be a
routable IP address.
In other words, I'm not going to use this system IP to this remote router.
So maybe it's a loopback on this router that's not at all part of the routing
domain.
That's perfectly fine. I just need to use this as an identifier. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That's perfectly fine. I just need to use this as an identifier.
So I know if I see another T-lock because a router can actually have multiple T
-locks that, hey, all three of these T-locks belong to the same router.
The next component of a T-lock is the color.
The color is one of many different predefined strings, which is essentially a
description of the WAN circuit.
And that's the important part about this.
It's supposed to represent a particular circuit inside of our SD-WAN topology. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's supposed to represent a particular circuit inside of our SD-WAN topology.
So if I have a router and I've got a circuit connection to the MPLS space,
and I also have a circuit through another service provider, maybe it's another
MPLS circuit, maybe it's the internet,
but we have two different transport mechanisms here coming in as two different
WAN circuits.
Well, I would assign a different color to each one of these.
And this color could truly be a color.
As Cisco allows us to assign things like red and green. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
As Cisco allows us to assign things like red and green.
And so I could assign red to one and green to the other.
We also have silver, bronze, and gold colors that we can assign.
So it's a little bit more of a, hey, this is my gold color, and this is my
silver color from a quality perspective.
And they also have a few other strings that represent circuit types like MPLS
and 3G.
But either way, I'm going to choose globally what the color for each one of my
WAN circuits is.
And I want to make sure that I associate the same color to each one of those. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I want to make sure that I associate the same color to each one of those.
Now, this is interesting because if I have different colors, again, let's just
use red and green here.
And that's part of my transport locator.
This probably implies what I said earlier, which is we can actually have
multiple T-locks.
In fact, we usually will find that we have a T-lock per WAN circuit.
So if I have these two WAN circuits on the left, I'm going to have a T-lock WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if I have these two WAN circuits on the left, I'm going to have a T-lock
that represents the one.
And I'm going to have a T-lock over here that represents the other.
And we can start to think about the T-lock as if it's an interface, but it's
also an interface without an IP address.
It's not the same thing as a layer 3 interface.
It's just a logical connector, or again, just start calling it a T-lock that we
use to connect to other SD-WAN routers across the WAN circuits.
Now, the last component in all of this is the encapsulation method. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, the last component in all of this is the encapsulation method.
Which is going to be either IPsec or GRE.
As we keep saying, ideally, it's IPsec for the sake of security, but there
might be situations where it needs to be GRE.
Naturally, if I've got router up here connecting to these circuits and wants to
run IPsec and the other one wants to run GRE, that's not going to work.
Instead, we're going to have to make sure that we share the encapsulation WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Instead, we're going to have to make sure that we share the encapsulation
method across this particular circuit.
So notice that when we bring all of this information together, again, we're
essentially providing information that can be used to build out a tunnel.
It includes information about the fact that, hey, I have this router ID and
that will show up across potentially multiple WAN circuits.
But then I also have a way of representing that this T-lock belongs to a
particular WAN circuit.
And lastly, in most cases, we don't need to think too hard about the encaps WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And lastly, in most cases, we don't need to think too hard about the encaps
ulation method because we're going to choose one and have that available for the
entire SD-WAN environment.
But this does allow me to start forming tunnels from these two devices over
here across multiple circuits.
And so I'm going to form a tunnel here between T-locks through the MPLS
provider, but I'm also going to form a tunnel this way, which is why we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
provider, but I'm also going to form a tunnel this way, which is why we
typically see a tunnel being formed per WAN circuit.
If I have two WAN circuits, I've redundant connections.
I want to form tunnels to the other SD-WAN edge devices in my network.
And I want to create a tunnel across every single one of those WAN circuits for
the sake of redundancy and load balancing.
Now an important part of all of this is we notice that the IP address isn't
actually a part of the T-lock. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
actually a part of the T-lock.
I have a potentially not-routable IP address.
It could be routable, but I'm not going to be able to rely on it being routable
, and so I can't use it to connect to the other side.
Instead, we're going to find that the control plane element, specifically OMP,
a protocol we're talking about in the next video, is going to not only share
the T-locks among all of the different WAN edge devices, because the WAN edge
devices need to know about the remote T-locks, but it's also going to share the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
devices need to know about the remote T-locks, but it's also going to share the
IP connection information.
So how do you connect to this other WAN edge that has a T-lock that you want to
connect to?
So then the question we- the next question we might want to ask is, "All right,
so we have a bunch of T-locks. How do we go about forming tunnels among T-locks
?"
And there's one overarching goal when it comes to deciding these kinds of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And there's one overarching goal when it comes to deciding these kinds of
things.
When we're trying to decide how to form the tunnels, a router, a WAN edge
device wants to form a tunnel from every T-lock to every T-lock.
Now that is some implications, doesn't it?
So we just said that we're going to have a T-lock on each WAN circuit.
And so if I now draw this out again, where I've got my two different service WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so if I now draw this out again, where I've got my two different service
providers, like this, and I know that I've got MPLS on one side and internet on
the other side,
that I'm going to form a WAN tunnel from one T-lock to the other via MPLS and
one through the internet.
So the question is, does this MPLS T-lock want to form a tunnel to the internet
T-lock on the other side and vice versa? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
T-lock on the other side and vice versa?
And the answer is absolutely yes. It wants to form a tunnel from every T-lock
to every T-lock.
This gives us redundancy and it maximizes, again, our load balancing.
It maximizes our options if we have multiple connections. From a real world
perspective, can this MPLS T-lock connect to this internet IP address through
the MPLS circuit?
Probably not, but we might actually find, especially on the internet with WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Probably not, but we might actually find, especially on the internet with
public IP addresses, that we can.
And this gets even more likely if this isn't an MPLS circuit, but another
internet circuit. Because the two internet worlds are not really separate
clouds,
unless we're building it over a DMVPN or something like that, if we're just
using the raw internet, and these are connected.
And it's just a bunch of public IP addresses, at which point I will see a full
mesh of tunnels be formed across these two different T-locks. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
mesh of tunnels be formed across these two different T-locks.
What if I don't want this? Well, I do have the option as an admin, and I can
lock this down to only consider T-locks of the same color.
It's one of the reasons why we share the color information, and that will make
it so we don't actually even try to form these tunnels between T-locks that are
part of different colors,
which ultimately means they're part of different WAN circuits. Now, one last WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which ultimately means they're part of different WAN circuits. Now, one last
fun part about forming tunnels via T-locks is what happens if I have a
redundant network with two routers,
maybe running a first-hop redundancy protocol between them. And then I say, all
right, I've got these two different WAN circuits.
I'm going to bring one of them into one router, and the other one into the
other router.
So here's my MPLS, here's my internet, or whatever the situation is there. That
's kind of interesting, because now, if I'm forming a IP-seq tunnel through the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
's kind of interesting, because now, if I'm forming a IP-seq tunnel through the
MPLS, and this MPLS goes down,
this router has just lost connection to the SD-WAN environment, which is not
ideal. We want to use the overlay and use these tunnels to try to stay up,
but the problem is I can't form a tunnel through the internet to the other rout
ers, simply because I'm not connected to the internet.
The other router is. So what we can do is use the concept of a T-lock extension WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The other router is. So what we can do is use the concept of a T-lock extension
.
The T-lock extension allows me to actually go through the other router in order
to form my other tunnel.
So as we draw the tunnels out, now I can form tunnels. Let's just say we've got
a device out there, another WAN edge that has a connection into both.
So I can form my tunnel this way, and my tunnel this way, but now I can
actually use this T-lock extension here,
and the T-lock extension allows me to have a T-lock in the internet color, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and the T-lock extension allows me to have a T-lock in the internet color,
whatever that color is, and I go through the other router
to form my tunnel. And naturally I do it the other way around as well. This
router has a T-lock in the MPLS color,
and it allows me to use the local network to communicate over to the other
router and out the MPLS circuit.
And I could use the local network, or I could actually have a layer three
interface between them, specifically for this purpose, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
interface between them, specifically for this purpose,
which is typically how we'd want to do that if we have the luxury of doing so.
So this T-lock extension can support redundant routers that each have a single
WAN circuit.
Very useful in a situation where I just don't have the luxury of connecting
both WAN circuits to both routers.
In a perfect world, that's what we would do is we would just give each router
its own connection to both WAN circuits,
but again, real world scenarios. I don't always play by the rules, or at least WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
but again, real world scenarios. I don't always play by the rules, or at least
the desirable rules.
And so this T-lock extension gives us a great option for maintaining the value
of having many tunnels across many different WAN circuits,
even if I don't have a direct connection to those WAN circuits.