Recall how the topology ends up getting built.
First of all, when we say topology, we're talking about the overlay topology.
The software defined network that we're building, which is part of the entire
point of SD-WAN.
So we have a physical underlay, and the overlay is going to be the set of
tunnels that we
use to build the network that we want.
We always say the overlay is the network that we want, whereas the underlay is
the network
that we have.
We're going to use tunnels and specifically IPsec tunnels, and technically, GRE
tunnels
is an option in here, and the real world we're going to use IPsec.
But either way, those IPsec tunnels are going to give us our overlay network.
So how exactly is the overlay topology going to get built out?
Well as we've said before, the default topology is going to be built using full
mesh.
Now we can change this, and we'll talk about how we do this, but it's important
for us
to understand the full scope of what we mean by full mesh.
Because this goes beyond just every edge communicating with every other edge.
Let's see what we mean here.
So let's say that we've got a set of three nodes here, and we're connecting
across two
different WAN circuits.
So all of these routers will just say have connections into service provider A
and service
provider B.
So what's going to happen here?
Well keep in mind that we are going to build tunnels, and we want to build a
tunnel to
every other edge router across each one of these service providers.
So we're going to build some tunnels here through service provider A, and kind
of kind
of try to work around service provider B there to showcase this.
And then with B, we'll use a different color here, and we're going to also form
tunnels
in a full mesh capacity among all three of these through service provider B.
So this is part of what I mean by the fact that full mesh goes a little bit
beyond every
router communicating with every other router, because they're actually going to
do this
across all of the service provider clouds.
In fact, if we have another cloud in here, then we're going to see three more
connections
show up through that cloud.
But the other part that I'm talking about with why this goes beyond this is
there's
a reality here where service provider A and B actually have communication
between them.
They have connectivity.
And what this creates now is a new set of connections, because now this router
here on
the left can go through service provider A across the link to B, and then
communicate
down to this router down here, going through A and B together.
The amount of tunnels that we're starting to talk about here is just enormous,
because
now all of them are going to be able to do this across both of these
connections.
Let's see here, which one?
There we go, right across.
So we're starting to see more and more tunnels show up, and this is why we must
contain and
control how many tunnels we're creating.
Now, what situation would service provider A and B be able to communicate with
one another?
Well, the most common example is just going to be what if those are both
internet circuits?
Naturally, the internet is just one big network, and therefore, if I have a
connection to
ISP A and another connection to ISP B, well, those are both going to the same
large network,
the internet, and therefore, I can reach out to a router who's connected to ISP
B through
my ISP A connection.
But this can go beyond just internet.
But if I have two different MPLS circuits and because of the way that we do our
routing,
maybe it's the same service provider and the same underlying network, and we
actually
have connectivity that way.
Usually not going to happen with MPLS, but certainly we might have the internet
on one
side and MPLS on the other, and the MPLS is providing internet service through
the MPLS
network.
So we can get very complicated, and it's actually not that far out of the realm
of possibility
that we do see connectivity possible between the service providers.
And so this is why very seldom do we actually want to keep this default in
place.
First of all, we see the enormous problem with the scaling.
We're going to have way more tunnels than we want to be able to manage, or
maybe can
manage, especially when we're talking about hardware limitations.
But the other reality is that if this is the headquarters site over here, and
maybe we
have our primary internet circuit, so we've got a firewall here and some
internet inspection,
and we want everybody to go through this one internet.
Maybe we've got the data center out here.
In most cases, all of our users are trying to go to the headquarters location
if that's
where all the resources are, meaning do these two sites even need to
communicate with one
another?
If that's the case that they don't need to communicate, then at that point we
can eliminate
a lot of these tunnels and go to some kind of point-to-point connection, or
probably
more likely a point-to-multipoint type of cloud, basically a partial mesh is
what we'd
be talking about at that point.
So how exactly do we go about controlling this?
Well, in order to talk about controlling the topology, we need to come back to
the concept
of how exactly all of these tunnels are getting built out.
And at the heart of that operation is the transport locator or the T-lock.
And we'll talk about T-locks here.
So the concept of T-locks, or again, these transport locators, is that they are
a three
tuple of information that essentially serve as a connection point.
And yes, I'm going to use quotes here because we have to be careful when we're
talking
about and thinking about T-locks because it's easy to equate this or want to
equate these
to some kind of layer three interface or something along those lines.
If I'm going to build a tunnel to another router in a classic network, then I'd
need
a layer three interface to build towards, for example.
And so we might start to think that, oh, these T-locks are interfaces, they
have IP
addresses, but that's not the case.
These are not going to be something that we can equate to a classical network
construct,
like a layer three interface.
Instead, the T-lock can be thought of as a connection point that isn't a
network concept
strictly speaking.
Instead, it's that three tuple of information.
What information is in there?
We'll draw down here.
We need to think through the fact that it includes things like a router ID,
includes
very importantly the color, which is going to equate essentially to a circuit.
Each circuit is going to have its own color assigned.
We'll talk more and more about colors here as we progress.
And then the encapsulation is also in here coming back to the fact that we
could run
IPsec or GRE.
So when we look at this, a router ID, for example, is the closest thing we're
going
to get to an IP address that we could ping, for example, except keep in mind
that router
IDs don't have to be pingable.
These can be unreachable in the network.
In fact, we might intentionally use unreachable IP addresses because we want
the router IDs
to be unique constructs in our network, something that represents the router
and not a routable
address.
So when we look at all three of these together, we don't see anything in here
that matches
to MAC addresses and IP addresses and ways to route packets.
The network can't do anything with the T-lock, strictly speaking.
So what exactly is the T-lock?
Well, again, it's a connection point that gets known, and then the glue here is
that
if I have a router and I'm going to look out and see another router and I see
that this
router has a T-lock that I want to connect to, then I'm going to need
information from
the vSmart or our controller.
It's going to provide it via a T-lock route over OMP.
This will tell me how to build the tunnel to the T-lock.
But before I even get to the point where I need to build the tunnel out, I just
need
to know what are the T-locks that I'm trying to reach out to.
And so what we'll find is that this router, let's say has a T-lock that is
mapped to
a specific service provider, let's say this is the service provider A T-lock,
well, we're
going to have another T-lock down here that is mapped to service provider B.
These might
be two different colors.
Maybe we'll use Biz Internet, which is one of the colors.
That's in the SD-WAN configuration, we'll see that later.
And then this one down here maybe is Metro Ethernet or something along those
lines.
And so we have two different circuits.
Well, they really translate to two different colors.
And because color is in the T-lock, that creates two different T-locks.
So this router now gets to decide, am I building out to one of these T-locks,
both of these
T-locks?
And maybe we're building out to none of these T-locks.
But we can decide which T-locks we're going out to.
And then we use the network information in order to build the actual tunnels.
So again, think of the T-lock as something that we can use for decision making.
We're going to make our decisions for our connections based on T-locks.
But we don't actually get to use the T-lock to build a tunnel.
So when we go back to the default behavior of saying we see that all of these
edge devices
are forming full meshes, what we can really translate that into is saying that
they're
going to try to connect to every T-lock that they see that's out on the network
.
And yes, they will use different colors of their own T-locks in order to
connect out.
So in our case here, if I have a T-lock that's also tied to SPA, or maybe we'll
just call
this the Biz Internet Color T-lock, and this T-lock is Metro Ethernet, we might
expect that
we're only going to form or attempt to form two different tunnels.
But the reality is, again, it's full mesh.
So this T-lock for Biz Internet wants to also connect to this T-lock down here
on Metro
Ethernet and Metro Ethernet to the Biz Internet.
And so we have two T-locks on each side and therefore it becomes a full mesh.
Now these crossover connections can only happen if, again, our service
providers allow for
connectivity between them.
Otherwise the IP connectivity won't go anywhere.
But if that connection point does exist, this is where we can end up with full
mesh.
So here's the big question.
How do we control our topology?
Well we're going to leverage T-locks for this in most cases.
And so there's several different ways that we can do it.
First of all, when it comes to our T-locks, we can restrict our T-lock
advertisement.
And this is typically what we're going to do.
This is the usual method in our real world networks.
So the V-Smart and, or the controller is advertising our routes.
Well it's also advertising the T-locks.
This is how we learn about them.
And so if the V-Smart simply doesn't advertise certain T-locks, well at that
point we don't
have to worry too much about certain routers connecting to other routers.
So if this device down here is also trying to form connections up to maybe our
headquarters
location over on the left, I simply don't have to advertise the T-locks down to
these
other devices that would allow them to form connections to one another.
Instead, they don't even know about each other's T-locks and so they don't
attempt to form connections.
So again, that is our usual method and is especially effective when we don't
want devices
communicating with one another.
We can also declare a color to be restricted.
A restricted color changes the rules a little bit away from what we said
earlier.
How even a Biz Internet type of T-lock will want to connect to a Metro Ethernet
T-lock down
here.
If I create a restricted color, it's only going to allow same color connections
.
Meaning that my Biz Internet T-locks will only form connections with other Biz
Internet
T-locks and they won't be able to form connections with T-locks of different
colors.
Now the last method doesn't involve T-locks.
We can just use site to site policies.
This is going to look a lot like classical networking where we are essentially
using
something like ACLs or access control lists in order to block communication.
And so we'll see this method as well because we might just want to block
certain connection
points at the CLI by getting onto routers and forming them they're not allowed
to communicate
with other devices.
So in the end we have been given quite a few different methods here for
controlling our
topology.
And so our takeaway here is to first of all understand what is going on with
our overlight
topology creation and the fact that at the heart of this is the T-lock.
Now those are connection points and how they're advertised so we know which
other T-locks
are out there.
And then we have to come back to the control elements to say by default they're
all going
to try to talk to each other which can't even cross over between colors.
And so which control method are we going to use to get the topology that we
truly desire
in our network?
You