All right, our edges are now in the active state and our switches are both
online, meaning
our virtual circuits, our internet and our MPLS of sorts are both active.
So what do we need to do now to form our data plane tunnels?
The answer, interestingly, is technically nothing.
They have already formed a bunch of data plane tunnels, just not how we want to
do it because
it's outside of our intention.
Namely, they're all using those default T-locks and we don't want to be using
default T-locks
and we don't necessarily want full mesh of connections either, but it did reach
out and
start to form all of these tunnels by default.
So let's go and take a look at that.
If I switch over to my monitor, maybe we're on the overview tab here, we can
switch over
to the tunnels tab and here we can see all of the tunnels.
It tells us the device that's initiating the tunnel, the device on the other
side of the
tunnel and then we see the source T-lock and the destination T-lock.
All of these are using the default T-lock because we haven't actually
configured or
the default color, I should say, because we haven't actually configured any of
the colors
yet.
So now what we want to do is we want to create our intentional T-lock colors.
We want to get those assigned to these interfaces and start to control a little
bit better,
which tunnels are connecting to which other devices are connecting to the
devices themselves
via these tunneled connections.
So we're going to start by switching over to the CLI and we're going to perform
the configuration
on our edges 13 and 14.
So over here on the right, we're going to deploy CLI configuration to edge 13
and edge
14, keeping in mind that these two configurations are different than 11 and 12.
11 and 12 are identical.
They're connecting via gig one to the internet and via gig two to MPLS and both
of them are
configured in that way.
13 is unique because it has a connection to the internet and that's it and 14
has a
connection to MPLS while also maintaining an internet connection for the sake
of communicating
to the control devices.
But what we want to see happen is edge 14 only forming tunneled connections out
the MPLS
circuit and then edge 13 naturally can only go out the internet circuit.
But it starts by deploying colors to these interfaces.
And so let's go ahead and switch over to the CLI to make that happen.
So here I'm on edge 13 and I can do a quick verification of those tunneled
connections.
I can do a show SD-WAN and we've got several options for this.
In this case, we're just going to do BFD sessions.
Remember, BFD is run across every single tunneled connection.
And so I can just check to see, hey, how many BFD sessions are we running?
And so we see again, this is from the perspective of edge 13, I see a
connection out to router
11.
That's the router ID for router 11.
Same with 12, same with 14.
So we are forming these connections and we can see references here to the
default source
T-lock and the default as the remote T-lock.
Yes, this is a little bit jumbled as always because of the resolution and just
making
it large enough to see when you're logging in on your lab side, this will look
a whole
lot cleaner as an output.
But it's important to keep in mind this show SD-WAN BFD sessions is a really
good way to
perform verification.
We can also do something like show SD-WAN IPsec outbound connections.
And so once this output is generated, then we can see how many of these tunnels
are formed.
The output's a little bit different.
It gives us some IPsec information, but we can see that, hey, this is my IP
address.
I'm router 13 here, or edge 13.
So dot 13, this is my address.
And we can see that I'm connecting to router 11 via the default color and so on
and so
forth.
So we have slightly different pieces of information out of each of these, but
those are both great
commands show SD-WAN IPsec outbound connections as well as show SD-WAN BFD
sessions.
But let's go ahead and start to change some of this configuration because again
, part
of the value of SD-WAN is controlling the connections.
We're going to do that with the T-locks and we want to change the color away
from the default.
So what we're going to do here is we're going to do not a config T. Remember,
we can't use
that when we're configuring our edge devices that are in controller mode.
Instead, I'm going to have to do config-T.
Seems a little arbitrary, but it's one of Cisco's ways of making sure we are
being very intentional
with what we're doing.
Plus the behavior once we're in config mode is different.
Remember, we have to perform those commits in order to make changes.
Now one thing once we're in config-T mode is in a lot of cases, we'll want to
enter
into SD-WAN configuration mode simply by typing SD-WAN and hitting enter.
This is where we can perform SD-WAN related configurations.
If we want to, for example, configure an IP address on an interface, then I
would do that
using normal-ish iOS commands.
I'd just stay in config mode and go down to the interface and change IP
addressing and
just exactly what we'd expect out of an iOS XE type of device.
But if we want to make SD-WAN changes, we might say, "Okay, well I want to get
onto
an interface and add the tunnel interface command.
Well, tunnel interface is an SD-WAN concept."
So I can't just get onto the interface and do that.
I have to get into SD-WAN configuration mode.
And for the most part, we can think of it as if I'm using Viptela-like commands
, it's
going to be inside of the SD-WAN config space.
If I'm running iOS XE types of commands, then that belongs outside of the SD-W
AN space.
There's kind of an interesting nuance with how Cisco has combined their iOS XE
platform
with the SD-WAN world by bringing Viptela commands into it.
So now that we're in SD-WAN operation, again, this is like its own little mini
Viptela space,
I can now also perform commands like getting onto an interface, like interface
gigabit
ethernet one here.
And we do have to be very careful about the spelling of this because if this
interface
doesn't exist as I type it out, then when I commit it, it's going to cause
problems.
So we have to be very careful of this and this is something I'd encourage you
to play
with in your own lab environment.
Now from here, I'm going to enter that magical tunnel interface command.
The tunnel interface we think would make this even longer go to gigabit ether
net one dash
tunnel dash interface, but I think at that point it would just be ridiculously
long and
our commands would be over here.
So it does abbreviate it down, but this tunnel interface command that we just
entered puts
us onto a tunnel interface configuration prompt that's inside or on that
interface.
So we talked about this before.
The tunnel interface command not only enables tunnels on this interface, but
also disables
all non-tunnel traffic unless we're explicitly allowing something.
So this has to do with that discovery concept when we talked about PNP and ZTP
and the fact
that if I'm going to allow things like DHCP and DNS, that exists outside of the
tunnel.
And so I need to make sure that those are enabled.
And fortunately Cisco out of the box will enable some of those services.
But if I need other services enabled outside of the tunnel, then I'm going to
have to think
through that and how exactly that will work.
This tunnel interface command again, not only enables tunnels, which by default
it was because
we told it that when it booted, but not only enables tunnels, but it disables
non-tunnel
traffic, which can be a very big deal.
But it's here where we define our color.
So I'm going to type color and question mark, and we'll see the list of all of
those colors
that I listed out on the chalkboard earlier.
And so we see they're not nearly as nicely sorted.
For example, we got 3G up here, we've got LTE down here.
We have that blue and red and green is sort of split lines there.
This is the green right there.
Those are all split up our gold and our silver split up from bronze, wherever
that is.
There it is.
And so it's not quite as organized as our previous list, but we do see them all
there,
including custom one through three and private one through six.
So default is the default setting or the current setting.
And so we're going to say color.
And again, with gig one, we want this to be biz internet.
But again, we see that I can't just type anything here.
I have to pick one of the pre-configured defaults or pre-configured colors.
So I've selected biz internet.
I'm going to exit out of this and exit out of it again.
And now this is the important part.
I need to commit my changes.
If I try to exit out without committing them, then those changes will not be
taken effect.
Fortunately, Cisco will ask the question, hey, you've got uncommitted changes.
What do you want to do about those?
All right.
So we just changed the color on gig ethernet one.
And so let's just go ahead and do a let's see here.
Let's do show SD WAN BFD sessions.
And we do see now that we have reformed these tunnels, but now they're sourced
from a different
T-lock.
They're sourced from the biz internet T-lock that we just established, but it's
still
connecting to default T-locks on the other side because edge 11, edge 12, and
edge 14,
or we haven't configured those yet.
So that's exactly what we're hoping to see.
That's as simple as that.
We took the some time there to explain things, but it's a fairly fast
configuration.
And we'll see that here on edge 14, we'll do the same thing, but quite a bit
faster.
So I'm going to do my config -t, get into that SD WAN configuration mode.
And from here, I'll get onto my interface.
In this case, gigabit ethernet one.
And then tunnel - interface to get onto the tunnel interface.
And then I can set the color here.
Now just to quickly bring up the topology, we do see that with gig one on edge
13, that
was configured to connect to the internet, whereas edge 14 again, gig one is
connected
to MPLS.
So we do have to make sure we get our colors correct.
So let's go ahead and do that.
We're on gig ethernet one.
I'm going to use the color command to enable MPLS as the color, exit out of
that, and
then we'll do a commit.
Let's see here.
Oh, that's right.
One other thing that actually is very important, I forgot to mention, the T-
lock requires the
encapsulation type.
We had to configure the encapsulation type here in order to make it come up.
Why didn't that - wasn't that required on edge 13?
Well let's go back and take a quick look at the topology.
Remember, we allowed these devices to come online and form connections out the
internet.
As part of our configuration, when we brought these devices online, if we
scroll down and
take a look at the initial config, we'll find that we were applying our IP
addresses to
interface gig one here to allow us to bring these online, again, gig one
connected to
the internet.
But notice all the way back up at the top, we have this cloud configuration
section, which
is effectively going to apply SD-WAN configs, and notice this WAN-IF parameter.
What we did was we told, from a bootstrap perspective, we told this router that
when
you come online, apply WAN configuration to gig ethernet one.
What did that WAN configuration look like?
It involved configuring it to be a tunnel interface and to have its encaps
ulation set.
So that's why we already have IPsec tunnels everywhere, is because we have
configured
T-locks effectively by configuring these interfaces.
So that's why on edge 13, we didn't need to specify encapsulation because it
was already
configured.
We already saw we had IPsec tunnels out this interface.
Edge 14 was a different story because when we look at edge 14, we see that we
told it
that gig two was actually the configuration for forming tunnels so it could
form tunnels
to the control components.
So let's go back to edge 14 now.
I just want to abort this and do a show SD-WAN run so that we can see what we
're talking
about here.
When I go down to down here, there we go.
So notice under the SD-WAN configuration, we see interface gig ethernet two
with tunnel
interface and this encapsulation set.
Notice there's nothing here about gig ethernet one.
So if I'm going to get into a gig ethernet one, I can create a new
configuration, get
on to tunnel interface and I can specify any of these allow services.
So for example, we see DHCP DNS, ICMP, HTTPS, these are all enabled by default
like we said
and then I can see the other options that we have available to enable if we so
desire.
But the key here is that we want to configure a tunnel which right now it's set
to the default
color and then we also want to specify the encapsulation as part of that tunnel
.
So we need to replicate that with gig ethernet one.
That's great for gig ethernet two.
Now we're going to do this one more time.
We get into config T, do our SD-WAN configuration, do an interface gigabit
ethernet one and now
we're going to get on to the tunnel interface here.
From here we can specify the color again, we want color MPLS and this time we
're going
to specify encapsulation as being IPsec.
Now when I exit and exit out and do a commit, we should see that, oops, no
tunnel interface
found with tunnel source set.
Okay, I definitely messed this up.
Where is all this information?
So let's go ahead and make this happen.
So we're going to switch back to edge 14.
I'm going to abort this and there's actually two things here that we have to do
that we
didn't have to do with edge 13 for the reasons that we said and far as far as
bringing things
online.
So first of all, let's just do a show SD-WAN run and I want to show what
exactly we're
talking about here.
So when we look at show SD-WAN run and space down a little ways, we're going to
see this
SD-WAN session or section and then we see that there's an interface gig two
configuration
with tunnel interface.
The color is not specified here, but it's the default, which is why it's not
there, but
it does have encapsulation specified.
From there, we actually see that, hey, because it's a tunnel interface, it's
not going to
allow anything outside the tunnel unless we allow it.
And so we do see the four different services here that we said were allowed by,
whoops,
there we go, by default, as well as some of the services that we could enable
outside
the tunnel, SNMP might be a good one to enable outside the tunnel as well, but
it would
require us to explicitly allow it.
So that's great that all of this is here for gig ethernet two, but that's not
here for
gigabit ethernet one because it wasn't part of our initial config.
So great.
So we want to get on here and do interface gigabit ethernet one and configure
encapsulation,
but we're going to actually need a little bit more config as well.
If I scroll back up just a little ways, we're going to see this right here,
which looks
very like classic iOS XE interface tunnel zero.
Notice what tunnel zero is doing here.
Tunnel zero is tying itself to gig ethernet two, both from an IP address
perspective using
the same IP as gigabit ethernet two via the IP unnumbered concept, but then it
's also
going to use it as the source interface and it's in tunnel mode SD win.
This is great for the tunnels that are going to be formed out gig ethernet two,
but we
are not going to be able to use this tunnel interface for gig ethernet one.
And so if we're following here, there's a lot of default configuration that
came from
our CML deployment that worked really well for getting gig ethernet two up and
running.
It deployed a tunnel interface, it created the like a tunnel zero interface,
and then
it created SD win configuration as well, including the encapsulation and
default color.
Now we need to replicate all of that if we're going to bring up gigabit ether
net one.
And so let's go ahead and start by creating that tunnel, not tunnel zero, but
we'll create
a tunnel one interface from an iOS XE perspective.
And once that's online, then we'll be able to do the SD win config that belongs
to gig
ethernet one.
So let's go ahead and do that, I'm going to do my config dash T, rather than go
and jump
into SD win mode, I'm going to specify interface tunnel one.
And then I'm going to enter some of those commands specifically IP on numbered,
and
I'm going to tie this to gigabit ethernet one.
And then also tunnel source gigabit ethernet one, and then tunnel mode SD win.
So these are the commands we saw above minus the IP V six command since we're
not using
IP V six and our environment.
And I can exit out of the tunnel one configuration.
And now I can go into SD win mode.
Now I can specify my interface gigabit ethernet one.
Then I can enter into the tunnel interface sub configuration prompt.
And here I can do those other commands.
I can say color MPLS as well as encapsulation IP sec.
Oh, all right.
That was a lot.
But let's go ahead and exit out and exit out and do a commit.
And hopefully at this point, the commit took excellent.
So we've got everything in place that we wanted to see.
So if I do my show SD win run, we should see the results of what we did space
through a
little bit.
So now I have a tunnel one interface.
It was no shut down by default.
I entered the IP unnumbered for gig one tunnel source gig one and tunnel mode
SD win from
here down below under SD win here.
Now we see interface gigabit ethernet one here and under tunnel interface, we
've got
the two commands that I put in and then all of the default allow service
commands, which
we've talked about.
And then right below it, we see interface gig two is still there as well.
Now I'm able to do a show SD win BFD sessions command.
But as we see here, it's not going to list any more tunnels.
Why isn't it forming more tunnels?
Well, let's look at our topology one more time.
And there's a simple reason why we don't have more tunnels is because edge 14
was already
forming tunnels out this interface.
Now we're trying to form tunnels out the MPLS circuit.
But guess what other devices don't have tunnel interface enabled yet on gig two
edge
11 doesn't edge 12 doesn't edge 13 doesn't even have a connection.
Therefore, there are no other T locks available to form connections to before
right now, we
have configured edges 13 and 14 using the CLI, making sure that we went through
the proper
steps to convert a non tunnel interface into a tunnel interface, which required
us not only
configuring a tunnel itself, but then also applying the correct color and
encapsulation
configuration under the SD win section.