Alright, so now we want to make sure that all of the tunnels are in a place
where we
think they are and then we also want to resolve that extra tunnel that Edge 14
is using to
create data plane connections when we really just want control plane
connections outside
of it.
So here we are on the UI here, we're on the monitor and overview tab and we can
click
on tunnels once again.
We can actually start just by looking at tunnel health down here.
We do see some poor connections, we'll take a look at that momentarily.
In fact, let's just go ahead and click on the tunnels tab and we can take a
look and
see what's going on.
So we do see again, tunnels between Biz internet and Biz internet.
So that's good.
Here are these default connections on Edge 14 that we really don't want.
That default connection is really only meant to connect into the control plane
connections
or the control plane and management plane and orchestration plane, all the
control components
as Cisco calls them.
And so down here we see, okay, so we've got a Biz internet to MPLS.
Oh, maybe that's what's going on.
We're trying to form connections between the colors even though our topology,
which we
can click over and look at the topology, as we've said many times, we don't
have a
way to form connections from the internet circuit over to MPLS.
And so we might want to go ahead and prevent that from happening as well.
So we can take a look at that.
And maybe as we look down here, we do see that, okay, MPLS and Biz internet,
those are all
of the tunnels that are having problems.
So we want to clean this environment up a little bit.
But before we do, let's go ahead.
This is the UI way of confirming tunnels.
Let's click over to the CLI and take a look as well.
And so here we are on edge 11 and it's good to know a few different commands.
Some of these we've already used, but just as a quick review, we do have show
SDWAN IP
sec outbound connections.
If I enter on this, it's going to show me all of the IP sec tunnels.
It gives me some information again, because I use large text for recording.
And this looks a little bit jumbled.
It'll look a lot better on your screen, but we can see some information about,
you know,
we scroll up here, we see that we've got the source and destination.
So source and destination.
So from dot 11, all of these should be from dot 11 because I'm on edge 11.
And then the different devices that we're connecting to, like here, we're
connecting
to edge 14.
And then we do see, for example, the remote color in here.
And we can get some amount of information, including importantly, some of the
information
around our IP sec.
So for example, the AES version that we're using for encryption from here, we
could also
do a little bit more of a focus on the tunnels themselves.
And rather than the IP sec elements, I could do a show SD WAN BFD sessions.
This is interesting because yes, we're looking at BFD, which is bidirectional
forward detection.
But remember, BFD is run out every single data plane tunnel.
And so because of that, we can use it to track the status of the different data
plane tunnels,
because if BFD is having a problem, well, then certainly we're having a problem
on that
tunnel.
BFD is having a bad day.
That's a good sign that something is out of place.
So again, we do see some of these down connections.
And that's because it is trying to connect from visit or net to MPLS.
So again, we can kind of pick the command that will show us what's happening in
the
tunnel world and never forget that we're on a sea edge, one of our 8,000 V's,
for example,
and not just show run, but also show SD WAN run is very useful to us because it
shows
us, for example, right here all of the system information that comes out of our
V edge components.
Remember Cisco integrated V edge code into the sea edge or iOS XE.
And so we see some of that command here.
And then we space through and we see a lot of information that looks like iOS
commands.
But then we space down beyond iOS and then we see more SD WAN information here,
including
our tunnel interface commands.
So a few different CLI commands that are useful to know because we're going to
need
to be comfortable with both if we want to fully manage an SD WAN environment.
So we want to restrict some of these tunnels.
How are we going to go about doing this?
Well remember that we have this restrict concept.
When we add it to a color means that it can't connect to other colors.
And so we're going to use that to clean up our environment a little bit.
We want to apply it to edge 14.
So once again looking at this edge 14 has this connection up to the internet
out gig
two and we do not want to form data plane tunnels because this is mainly used
for control
plane connections.
What we can do is we can instead of using the default color, we can change it
to a different
color like red, we'll just use red as a pick an arbitrary value here or one of
the colors.
And I'm going to assign that the restrict property, which means that nobody
will try
to form connections with it unless they are also using the same color.
If it's the only color red in the environment, then then problem solved.
We're not going to form data plane connections.
So let's flip it back to our CLI.
We'll go over to edge 14.
We're going to do a config T and then get into that SD win configuration.
And once again, get on to our interface, in our case, it's gigabit ethernet to
the tunnel
interface itself.
And then the color, we're going to change off of default to red.
And then we have the ability to add restrict here as we see.
So I'm going to hit enter.
And now we should expect actually, let's commit that first, commit and then end
.
Now we should start to see those tunnels, the remote T locks respond by tearing
down that
tunnel and not creating new ones.
Now let's look at the topology one more time.
And we can see also that, or we recall that these edge devices are trying to
form tunnels.
They're aware of the fact that there are T locks on the other side.
So edge 11 is trying to form a T lock from its biz internet color to the remote
MPLS
color.
And by the way, and so we can use the restrict as well for that.
Let's go ahead and turn MPLS color into a restrict version as well.
So we're going to get on to edges 11 and 12 and place restrict there.
That's going to require some UI configuration.
And for now, let's get on to edge 14 and do that to gig one.
So we're on edge 14.
We see a whole lot going on here, but let's just go and do another config T.
And then we're really just going to follow the same process.
We're going to get into the SD win configuration interface gigabit ethernet one
this time,
and then get on to tunnel interface.
And instead of just color MPLS, we're going to say color MPLS restrict.
And then we'll commit and end.
So let's go ahead now and flip over to the UI and do the same thing on the
other routers.
So recall, anytime we're on the UI here, we're going to go to configuration,
come down to
our templates.
And this is where we're going to make configuration changes.
But not on the device template itself, we're going to go to the feature
templates, get
on to the MPLS interface configuration and say, let's edit that config.
And so once it fires up here and fully loads, we can scroll all the way up to
the top, please
get back towards the top.
And then we can scroll back down to that tunnel section where we define the
color MPLS.
But I'm going to change this to say, hey, for any device, edge 11 or 12, using
this
configuration, we're going to set restrict to on for MPLS.
I'm going to click update.
This will allow me to make sure and confirm that yes indeed, I do want to push
this down
to the two devices as we've seen, click OK.
And now we should see that get pushed down.
So let's just go ahead and take a look at the well, right now it's in progress.
So we'll just wait just a few moments for it to validate.
And then we'll go check the CLI configuration.
All right.
So again, just a few seconds later, everything is good.
Let's go ahead and switch over to our CLI and take a look at edge 11, we'll say
, we're
already logged in.
Just do a show, run SD, tend to do that backwards show SD when run too many
years typing show,
run something like show, run interface, I suppose.
And so we scroll back up here to look at interface gig ethernet one.
And now we, whoops, gig ethernet two, there it is.
And now we do have color MPLS restrict in place.
So that restrict was not there before.
So I'm going to do a show BFD sessions.
And notice now we are only trying to form connections to colors on the other
side that
match us.
So MPLS to MPLS, bus internet to bus internet.
We're not trying to form connections out.
And we're not trying allowing connections in if it doesn't match the color.
Now we didn't have to do the restrict on biz internet simply because there's
not a
third one out there.
So biz internet would be trying to connect to other colors, but the only colors
available
are MPLS as well as that red connection.
And both of those are configured for restrict.
So we don't need to worry about, I said a third, I suppose a fourth color out
there
because we do are using red now.
We don't need to worry about a fourth color out there within the scope of the
lab.
But otherwise we could just configure biz internet to be restrict.
And now we know how to go about doing that.
Let's look at it from edge 14's perspective.
If I do a show SD win BFD sessions.
And now we do see that again, edge 14 is only on MPLS with edges 11 and 12.
And so those are the only tunnels that we see.
Let's check, let's go back to the UI and make sure that it's properly reporting
things.
And so we're going to go to monitor and then overview.
Scroll down a little bit.
Okay, so our tunnel health is still showing that five tunnels are down.
If I click on tunnels here, see now they're outside of this list.
So it does take a while for certain elements to update.
But importantly, we do see on this list that none of the tunnels are actually
in a down
state because we're no longer trying to form tunnels between the colors.
So everything is MPLS to MPLS or biz internet to biz internet.
And life is looking pretty good.
At this point, we have connections where we want them in our environment.
And so our edge devices are communicating with edge to other edge devices out
the appropriate
color.
Specifically, we have in the MPLS space that edges 11, 12 and 14 have a full
mesh, the
MPLS side, and then edges 11 and 12 and 13.
These are forming the connections.
So it looks kind of like this where we've got connections forming among those
devices.
So from here, we can actually start to talk about VPNs and edge network, or
edge network
spinning up user and subnets and such because our data planes are properly
built out.
[BLANK_AUDIO]