Well, the format for these quizzes is going to be what we've done several times
up until
now, which is to ask some quiz questions, but I'm not going to pause the video
and give
a lengthy silence.
What I'd encourage you to do is once we get done reading the quiz question, you
hit the
pause button and make sure you can answer it yourself before unpause it and
watching
the solution in order to verify.
So for example, with this question here, what are the four planes of operation
for Cisco
SD-WAN?
This is an open ended question.
So again, hit the pause button, maybe grab a piece of paper and a pad of paper, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So again, hit the pause button, maybe grab a piece of paper and a pad of paper,
a piece
of paper and a pencil, whatever you need to write stuff down and make sure that
you can
answer this question yourself before again, we start to talk about the solution
.
So what is the solution here?
Well, Cisco's SD-WAN architecture is pretty sophisticated and it doesn't
involve these
four planes of operation.
We might be used to control plane and data plane when we're talking about
normal network WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
normal network
operations.
And certainly that's going to be the first two.
We're going to have a control plane of operation, which allows us to share
routes with one another,
make sure we know how to encapsulate our traffic and get it to the destination.
We have the data plane, which involves building those secure tunnels and
allowing us to send
traffic from one WAN device to another WAN device.
But there are a couple others here as well.
First of all, we have a management plane of operation.
This is how we manage the entire SD-WAN infrastructure from that single pane of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This is how we manage the entire SD-WAN infrastructure from that single pane of
glass is a huge part
of software defined infrastructure is getting us away from piecemealing
everything, configuring
dozens of devices to try to work in concert and orchestration with one another.
Instead, we simply log into one interface, one device and tell the network how
we want
it to run and it pushes that configuration everywhere.
It has an immense benefit to software defined architectures. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It has an immense benefit to software defined architectures.
The last plane of operation is that orchestration plane.
This is especially focused on onboarding.
We want to be able to streamline our ability to spin up new software defined W
AN, especially
those WAN edge devices and the orchestration plane is going to help with the
onboarding
process, help with dealing with our NAT, bypass and such.
And so all four of these planes of operation are mission critical for SD-WAN
operation.
Question number two, match the SD-WAN device to its plane of operation. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Question number two, match the SD-WAN device to its plane of operation.
So we just talked about the four different planes.
And what we find is that there's one device that belongs to each one of those
planes of
operation.
So which one is which here?
Well the SD-WAN edge devices would be the device that's actually sitting here
at the edge
of our network, of our wide area network specifically.
And so usually this is our layer three router type of device that's going to
communicate
into the site. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
into the site.
And then it will have ideally a handful of wide area networking circuits back
up into
the network.
So this is going to be responsible for sending traffic from one edge device to
another edge
device, which will communicate with another site.
Maybe this is the headquarters.
But either way, this device at the edge, this is part of our data plane of
operations.
So the V-Manage.
The V-Manage is going to be our management plane as the name implies. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The V-Manage is going to be our management plane as the name implies.
So this is where I as an admin once again need that single pane of glass.
I'm going to log into V-Manage and it's going to push configuration everywhere.
The V-Smart, this is the control plane device.
So my V-Smart are going to receive routes and routing information and it's
going to push
it down to the other WAN edge devices.
And then the V-Bond, this is part of that orchestration plane. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then the V-Bond, this is part of that orchestration plane.
And it's going to help me again with onboarding and that bypass.
So the V-Bond has to be out here with a public IP address.
It has to be reachable and fully accessible because again of that net bypass
part of the
operation.
So these are the four devices.
Also keep in mind, that Cisco has started to come up with new names for all of
these
devices.
In fact, the edge device used to be known as the V-Edge and also the C-Edge as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
In fact, the edge device used to be known as the V-Edge and also the C-Edge as
we talked
about.
So we're no longer calling the V-Edge.
Well, Cisco started to migrate all of these as well.
So when it comes to the V-Manage, we're talking about the SD WAN manager.
With the V-Smart, we're talking about the controller, which fits pretty well
with the
control plane of operations.
And then this is kind of the tricky one, orchestration plane, instead of
calling it
the V-Bond, they are now calling it the validator. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the V-Bond, they are now calling it the validator.
So let's start to keep these new terms in mind as well as we learn the
architecture and start
to get our hands on it.
It's going to depend on which Cisco documentation we're looking at, whether it
's calling it
the old names or the new names.
And so that's why it's going to be important that we know both.
Question number three, what type of tunnels are used for the SD WAN data plane?
So the data plane is going to use secure tunnels that communicate between our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the data plane is going to use secure tunnels that communicate between our
SD WAN edge devices.
And so those secure tunnels are going to be formed using IPsec.
So keep that in mind that when we've got our devices at the edge here, we've
got lots of
physical circuits and physical paths to one another.
But one of the ways that SD WAN simplifies everything is by building tunnels.
So I'm going to build, for example, an IPsec tunnel here across one WAN circuit
over here
as well with another WAN circuit or across the other WAN circuit. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
as well with another WAN circuit or across the other WAN circuit.
If they happen to both use the internet, we might see a full mesh of tunnels
forming.
But either way, these data plane tunnels are using IPsec.
So when a packet shows up on this router, it needs to go over to this other
site, it's
going to ride one of those IPsec tunnels to the other side.
That's what we mean by data plane operation.
And it's very important that we're using IPsec because a huge part of what we
're trying
to accomplish with SD WAN is not only simplifying our traffic flow and giving WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to accomplish with SD WAN is not only simplifying our traffic flow and giving
us more control
over it, but also adding a layer of security, whether that's because we're
riding over
the internet or because we're using a service provider technology like MPLS
that would be
shared with other organizations.
And question four, what does a VPN represent in Cisco's SD WAN architecture?
This one might be a little bit tricky because VPN, as we've said, this usually
means something
different, especially when we're already talking about IPsec tunnels. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
different, especially when we're already talking about IPsec tunnels.
But within SD WAN architecture, the VPN is sort of like a VRF, which we'll be
talking
about in more detail coming up soon.
But a VRF is essentially just a completely different routed domain.
And so the answer here is going to be D. It's a segmented routing domain.
And the primary reason we have this is for the sake of multi-tenancy.
SD WAN is a technology that regularly gets deployed by service providers, and
they sort
of sell the solution and manage it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of sell the solution and manage it.
But the customer doesn't get to interface with it.
We, as the service provider, are managing a multi-tenant environment, and
therefore every
customer is going to get their own VPN.
That's why it's called a virtual private network, even though from a strict
routing and switching
perspective, it really is closer to a VRF.
And so we need to think of it from both perspectives there.
But either way, it is a segmented routing domain, and it's going to allow us to
build
things out securely if we do have multiple customers. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
things out securely if we do have multiple customers.
If we're an enterprise customer, we're probably going to have just one VPN in
most situations
outside of some of the other VPNs that are used for management.
But if we have a use case for deploying multiple VPNs, then we can certainly
take advantage
of that as well.
All right, question number five.
We're halfway done, by the way.
I didn't say it at the start, but we have eight questions.
So we've answered four of them, four more to go, starting here with question
number five.
So what is the full VPN range in Cisco SD WAN and how are VPNs zero and 512 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So what is the full VPN range in Cisco SD WAN and how are VPNs zero and 512
used?
Well, the full range here originally actually was zero to 512, which is kind of
interesting
because, yeah, 512 is a binary number, but it goes one past the value.
Like if we were actually using nine bits, then we would have zero to five 11.
So we know we have more bits there.
It's just the Cisco and Viptela, especially originally, we're restricting it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's just the Cisco and Viptela, especially originally, we're restricting it.
The full range, at least at the time of this video is up to 65,530.
Yeah, not three or five 35 like we might expect, which is again, is another
binary number.
Those last five must be reserved by Cisco for some reason at this point.
But either way, that's the full range.
However, two of those values, zero and 512 are reserved.
And the reason why is zero and 512 of all these numbers comes back to the fact WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the reason why is zero and 512 of all these numbers comes back to the fact
that it
used to be zero to 512 was allowed with the first and last being reserved.
So our usable range actually is from one to five 11.
And then we have to put a break here and say five 13 to 65,530.
So this is the usable range of VPN IDs and zero and 512.
Again, our reserve.
So what are they reserved for?
Well, VPN zero, this is going to be reserved for the actual WAN circuits, which WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well, VPN zero, this is going to be reserved for the actual WAN circuits, which
is the
ultimately saying this is the underlay.
Again, this is a completely segmented isolated routing environment.
And what we're trying to create here is the idea that whatever this underlay
looks like
with multiple routers in the path that I'm just forming this tunnel and
allowing my routes
to flow over this tunnel.
And I don't need to know these routes in the overlay and the underlay doesn't
need to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
need to
know the overlay routes.
So we're creating this.
Draw it like this here.
We're creating these two different routing domains.
We're creating the underlay here and we're creating the overlay up here.
And generally speaking, we don't want those routes to mix, which is why we have
again,
if we think about VPNs as VRFs, that's why we have our YN circuits listed and
dedicated
as a as VPN zero.
Now we also have VPN 512.
This is used for out of band management. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This is used for out of band management.
And so this is really helpful and useful for organizations that like to isolate
their
management and keep that in a dedicated route and domain.
But as far as our actual usable VPNs for our data traffic, we're going to have
to pick
one of these VPNs.
Again, if we're an enterprise shop, we're probably just going to pick one of
these.
If we're a service provider, then we're going to use a whole lot of them
because every customer
is going to get their own.
Question number six, it's about T locks here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Question number six, it's about T locks here.
So what are the three components of a T lock, a transport locator?
So the T locks are interesting because the T lock essentially defines a path to
a router
or really a WAN edge device.
And yet it doesn't actually tell us how to get there.
Kind of curious.
We're going to need to rely on OMP to say, Hey, if you're trying to get to this
T lock,
go to this address.
So what's the purpose of the T lock?
Well, the T lock is used for making decisions. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well, the T lock is used for making decisions.
And I need to make decisions based on this three tuple set of data that's being
presented
by the WAN edge device, sort of describing itself and describing these
different paths.
So we can think of them as paths and how would we describe paths?
Well, first of all, we're going to include the system IP here.
So the system IP is again, not a routable or necessarily a routable IP address.
It's just simply an identifier to say, Hey, this is me. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's just simply an identifier to say, Hey, this is me.
And I'm going to use the same system IP across different T locks.
If I have different paths, the second part of the tuple is going to be the
concept of
the color.
The color is essentially trying to say that this is part of a particular wide
area network
domain.
So we've mentioned that a WAN edge device likely has at least a couple of upl
ink circuits,
especially if we're deploying SD WAN, if we just have a single uplink circuit,
SD WAN
isn't going to bring us a whole lot of value. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
isn't going to bring us a whole lot of value.
So it's usually going to be seen that we're deploying SD WAN when we have
multiple circuits,
we might even have three or four circuits at some critical sites.
Well, this creates three different service provider paths.
And as part of the T lock, I want you to know that, Hey, if you're trying to
come in on
this path, you're going to use this particular service provider.
So the color remember is a string.
And for better or worse, we can't define that ourselves, but Cisco gives us a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And for better or worse, we can't define that ourselves, but Cisco gives us a
lot of options.
And we can use things like red and green or gold and silver.
And there's all kinds of other ones as well, even descriptors like MPLS.
But this color is going to tell us about how I can approach and use this T lock
.
The last thing we need is the encapsulation.
So the encapsulation is going to tell me what I'm using, whether it's IP sec or
GRE.
But we just got done saying that IP sec is used at the data plane. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But we just got done saying that IP sec is used at the data plane.
And in every SD WAN deployment, this should be the case.
Outside of maybe a lab environment, I suppose.
But we do have GRE as an option.
GRE is essentially just saying, Hey, we're going to use an unsecured tunnel
rather than
relying on the security of IP sec.
There might be some really niche type of situations or corner case scenarios
where we
can't encrypt our traffic for one reason or another.
Maybe it has to do with the country of operation. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Maybe it has to do with the country of operation.
But generally speaking, we're going to be using IP sec.
As I have said, keep in mind GRE is technically an option.
And as a result, it's going to have to be included in the T lock.
So the T lock again consists of three components.
It's the system IP.
It's the color and it's the encapsulation that can include in the T lock.
And remember, these don't by themselves tell us how to route and get here.
We're going to need OMP to glue that part together later.
Question seven, which SD WAN device serves as an OMP route reflector among the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Question seven, which SD WAN device serves as an OMP route reflector among the
WAN edges?
Well, the answer here is just straight up the V smart, otherwise known as the
SD WAN
controller, I suppose with modern terms.
But either way, this V smart is going to serve as a route reflector.
What do we mean by route reflector?
And why did I use quotes here to describe it?
Well, it's because route reflector is actually a BGP term.
But as we've said a few times, OMP is very BGP like in its behavior. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But as we've said a few times, OMP is very BGP like in its behavior.
One of the ways that's BGP like is that it can perform its operations as a
route reflector.
Because unlike with our other routing protocols that use multicast, we're not
just forming
relationships with everybody.
We can kind of choose who we form relationships with.
And so I might have multiple WAN edge devices here.
And I want to share a route into this space. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I want to share a route into this space.
Well, if I'm not using intelligence here, as far like trying to make it a
little more
efficient, I might have many, many, many WAN edges here.
And if I was not going to use a route reflector or anything other, again, more
efficient,
I'd have to share this with every single other WAN edge device so they know how
to get to
this route.
Well, fortunately, I don't have to worry about that.
I don't have to maintain a full mesh of adjacencies, which as we can imagine, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I don't have to maintain a full mesh of adjacencies, which as we can imagine,
as this grows out,
it would become very unsustainable for us to have that many OMP adjacencies or
whatever
routing protocol we're using at that point.
Instead, the V smarts going to serve as a route reflector, which means I
advertise it
one time to the V smart and it's responsible for pushing it down to all of the
other WAN
edge devices.
So the V smart is a very important part of this.
OMP is a very important part of this.
And in this case, our focus is just simply trying to say, "Hey, I've got this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And in this case, our focus is just simply trying to say, "Hey, I've got this
route subnet
A I want you all to know about."
And the V smart helps me get the word out to the rest of the WAN edges that
route A lives
on my port.
All right, question number eight, the last question, which six parameters are
used to
identify a traffic flow for application aware routing when DPI isn't in use?
Cisco's deep packet inspection or DPI is really great for identifying traffic
types.
And this is important because as part of deploying SD WAN, I can look at WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And this is important because as part of deploying SD WAN, I can look at
traffic coming
in and identify the traffic.
And depending on the traffic type, I might want to send some traffic one way
and some
traffic another way.
For example, I might want to send my bulk traffic across an internet circuit,
but my
voiceover IP traffic should go out towards MPLS, something along those lines.
So the question is, how do I identify the traffic? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the question is, how do I identify the traffic?
And deep packet inspection is a great way to do it, but as we recall, it does
require
an additional license.
And we make sure we have the right hardware in place and all of that.
So we have a backup plan, which is to use the six tuple.
We talked about the three tuple, tuple earlier with T locks.
Now we're talking about the six tuple.
So we're simply going to equate a flow to the six tuple.
If we share these six pieces of information, then we are part of the same
traffic flow. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
traffic flow.
And so that's how we're going to identify our traffic.
So how do we do this?
Well, we're going to take a look at the six different, six different, I guess,
identifiers.
We have to look through each one of these.
So first of all, we're going to look at the IP address for source and
destination.
So that would be two of them.
We're not going to look at the MAC addresses because MAC addresses can be
deceptive.
If we're routing between two different routers, well, the source of destination
MAC address,
those are brand new. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
those are brand new.
They're just for those routers.
It doesn't tell us what actually is communicating.
So we don't want to rely on MAC addresses.
IP addresses are persistent end to end.
So would be the source and destination port.
That's another two of our six.
So we're up to four so far.
And then we're also going to take a look at DSCP and protocol number.
So these would be our six points of identifications.
It's going to allow us to identify traffic as it comes into the router, make
sure that's
going out the appropriate up link when we're using application aware routing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going out the appropriate up link when we're using application aware routing.
So that ends the quiz for SDWAN.
Let's go ahead and jump into a challenge to make sure that we fully grasp how
the architecture
comes together.