So at this point we have our control, our management and our orchestration
planes online, and now comes the fun part.
Because what we want to do is we want to bring up our SD-WAN edges, and that's
kind of the whole point,
is to actually have routers that can form tunnels to one another and start to
bring up data plane connections,
allow our different sites to ping to one another.
Now so far all we've done is set up these control devices, so when we're
looking at CML, we could say,
"Okay, well this is a great network," and it is, but again it's not actually
passing any traffic yet,
and so what we're going to do is zoom out a little bit, and we're going to
start to add sites down here,
where our SD-WAN edges will have connectivity.
Furthermore we want to make sure that we're taking full advantage of SD-WAN, if
we only have one WAN connection,
it's not a lot of incentive for us to deploy SD-WAN, it's probably maybe more
complex than we need.
Where SD-WAN really shines is when we have two or more WAN connections at every
site, so we're going to want a second WAN connection,
and in the end what we really need is a new topology.
So let's go ahead and flip over to our chalkboard and design that topology.
So we're going to have sort of this control area up here,
and all of these devices are connected to a single unmanaged switch in CML, or
our virtual environment,
and this is going to be part of VPN0. We're going to call this the Internet in
our lab topology,
and there's two reasons for that. First of all we need an Internet, or at least
we need a WAN circuit that we can use for one of our two,
and the Internet's a good candidate for that, but the other good reason for
that is it's actually connected to the real world Internet.
This is where our Cisco smart accounts live up here, our plug-and-play portal,
for example,
and this is how our control devices were actually able to register as we saw
previously.
So we have an actual Internet circuit, so we're going to take advantage of that
and deploy that into our topology.
But then we're going to want to set up a second circuit, and we'll call this MP
LS.
And we'll sort of play around with the topology over the course of time. This
is just how we're going to initially set things up.
Now right away we should notice that there is a gap between the Internet and
our MPLS circuit.
I'm going to go ahead and use quotes for this because in a lab environment this
isn't actually going to be running MPLS,
or multiprotical BGP. This is going to be another unmanaged switch, but it's
representing a different WAN circuit type.
And so again, definitely not actual MPLS, and yet we have it separated from the
Internet, which is what real MPLS would be.
So that's going to have some implications as well, especially as we try to get
our SD WAN edges online and operational,
because they're going to need the Internet in order to get online.
We can't just rely on some private network like MPLS in order to do so.
But there's another aspect to this that's worth mentioning.
We recall that our control devices had this connection up here to VPN 512.
And then we said that this down here is VPN zero. It's our connection to the
Internet from a control device perspective.
And that's correct. And so we say, okay, well the Internet is part of VPN zero.
What VPN is our MPLS, air quotes MPLS circuit, going to be part of?
Well, this is also part of VPN zero. And at first this might be a little bit
surprising, but when we really think about it, VPNs are VRFs.
What are VRFs? VRFs are an entire routing domain. So we can have many different
subnets associated with a single VRF or a single VPN.
VPN zero represents the underlay. And the underlay is part of a single routed
domain.
And so as long as we don't have duplicate IP addresses anywhere, we're good.
They can all be part of the same VPN. And so let's make sure we're thinking
about it correctly.
A VPN is closer to a VRF than a VLAN. If these were VLANs, then yeah, we would
have some, again, what we got here 192.168.255.0/24.
This is our single subnet we're using to represent the Internet. And now yes,
it's connected to the real Internet. And so all of these subnets are also part
of VPN zero.
But just keep in mind that in our lab environment, we only have a single subnet
that we're in control of. And so it would be really easy to think of these VPNs
as if they are VLANs, but they are not.
We can have many subnets as part of our VPN, because again, it's a VRF. And so
for our quote MPLS circuit, we're going to use a slightly similar yet different
subnet.
We're going to use 192.168.254.0/24. And so just to write this in here 255
represents the Internet. 254 is going to represent MPLS.
Now in your lab environment, you might have changed this subnet. If you're
using CML, you had the ability to do that. If you're using a non CML
environment, then your subnet could have been anything.
Just be aware of the fact that these subnets might look a little bit different.
And you can always change the subnets in your own lab environment in order to
make things work.
The important thing here is that we're thinking correctly about the fact that
all of this is going to be in VPN zero.
So all of that is great, but what is the point again of all of this? It's to
connect our SD WAN edges.
And so what we're going to do is we're going to create four different SD WAN
edges in this environment.
We're going to put two on the left in our topology diagram. We're going to put
two on the right.
And what we're going to do is we're going to assign these to individual sites.
So in order to keep these IP addresses unique and site IDs unique, we're going
to start with 11 here. So this is site 11 with edge 11. We'll call it and then
site 12.
We'll have edge 12. We'll use dot 11 and dot 12 as we start to connect into
these different networks. And so we'll see that site 11 connects to both of
these site 12 connects to both of these again, SD WAN really shines when we
have multiple
WAN connections, having a single WAN connection for all of our sites would
again probably mean that we overspent on the SD WAN solution. Maybe we got over
sold a little bit.
But if we do have multiples, especially with the internet out there, it's
pretty easy to get a second one. Then we're good to go.
But let's go ahead and make this over on the right a pair of routers that are
at the same location. So we're going to call this site 13.
And what we want to do is connect one of these routers to one of the circuits,
the other router to the other circuit.
We're going to have device 13, but also device 14 as part of this topology,
meaning that we've got dot 13 and dot 14 as well as part of these subnets.
Here's the catch on all of this. This device down here needs to communicate to
Cisco up here. It also needs to communicate with these control devices.
So what we need to do is ensure that we can do so by connecting this to our
fake internet, which is connected to the real internet.
But either way, we're going to still have to have this connection right in here
in order to make that happen.
Now, bringing all of these edge devices online is going to be the focus of the
skill. We're going to just get the edges online and make sure they're
operational.
And from there, we'll be able to maybe make some local networks and start to
see that the networks can ping across the SD WAN. That's going to be very
important to us.
But just to start with here, we're not going to be spinning up additional
connections, again, like downstream PCs and such.
But eventually what we want to do is make sure that we have a network
downstream of, now let me get myself out of the way here.
Downstream of devices 13 and 14, we're going to want to put a device down here.
We'll probably use an Ubuntu server for that just to be able to see if we can
ping these other locations.
So that'll come in a future skill or future video set.
But we also need to understand a little bit of topology here. When we're
talking about our SD WAN edges, there's a little bit of a dividing line here.
We have the transport connections upstream towards the WAN, and we have our
service connections downstream.
So this is important terminology, and we're going to want to be using this
terminology moving forward. So don't be surprised if you hear me talking about
the transport link or the service link or something along those lines.
Now lastly, the SD part, the software defined part of SD WAN, why do we call it
that? Well because we're building a software defined network over the top of
all of these circuits.
So what we're going to expect to find here is that we get site 11's router
forming a tunnel to site 13 and to site 14.
And importantly, we're going to form as many tunnel connections as we can. So
if for example, 11 can form a connection through the internet to site 12, but
then it can also form a tunnel to site 12 through MPLS, then it's going to do
that.
And even beyond that, we need to make sure we understand if these two WAN
clouds were to connect to one another, then we would start to form connections
through that connection or through that link. We'd form these tunnels.
Now we're not going to worry about that for the time being because these aren't
connected, but in the real world and maybe later on when we're taking a look at
things, and we do connect these together, we are going to find that there may
be more tunnels forming than we realize.
But again, as many as possible.
That's the rule. As many tunnels as we can.
All of the routers are going to be using this rule to try to bring connections
up. This is going to tie back to the T-locks, those transport locators, and we
'll get into more details about T-locks and OMP and how all this works once this
environment is actually built.
So kind of stepping back and saying, "Okay, that's great that we understand
that these SD WAN tunnels will be formed. That's great, but for right now, we
're not going to form any of those.
All we want to do is make sure that we actually get our control tunnels formed.
So we're going to be, these are different color there, we're going to be
forming control connections.
And the goal here is to make sure that each one of these edge devices has three
tunnels. We want to connect to the manager to the validator, which actually is
the start of this. So maybe we'll start with that.
Start with the validator, then we'll see the manager and controller connections
come online. That would be the ultimate goal of what we're trying to build here
is to get these routers online and connected to the control environment.
So with that said, let's go and jump in and start talking about authentication
because believe it or not, we're not ready to jump into the lab yet.
We have to talk about the process of making sure that all of these edge devices
are able to get online through our authentication mechanisms.