We've been working pretty hard to get our data plane connections online and we
have
finally established that.
We have four edge routers, 11, 12, 13 and 14 and we are able to establish
connections
across a couple of different service providers.
So right now our connections look a little bit like this with this being the
internet
connection and then we also have tunnels that look like this that are going
across the
MPLS circuit.
13 and 14 over here are supposed to be part of the same site and so we're
treating this
as if each one has a dedicated connection to one or the other as far as
circuits are
concerned but 11 is its own site and 12 is its own site.
So that's great that we've got our data plane connections online but really
what we're trying
to do here is build a network that allows us to connect users.
So bring on some kind of machine here, connect it to a network and allow it to
communicate
to a host at another site.
So in our case let's say we have an organization, we'll just call it
organization A and we have
host A here trying to communicate to host B and we want to make sure that we
can use
these data plane connections as we've built them out so that we can communicate
over to
host B and eventually ideally we put host C over here and we can communicate
that way
between maybe A and C and B and C and make sure that all of these hosts can
communicate
with one another.
I mean that's the entire purpose of our SD WAN fabric here.
In order to do this we're going to need to build what's known as a service or a
service
side VPN.
Now we recall that VPN zero is reserved so we can't use VPN zero, VPN 512 is
also reserved,
we can't use 512 and so we could use one, we could use 511, we could use 513,
we could
use 1000.
In our case let's just say that we're going to use service VPN 10 here.
So VPN 10 will be used for organization A to connect all of its users across
this SD
WAN environment.
However, we also want to keep in mind that Cisco's SD WAN product as it was
developed
by Viptela was created to be multi-tenant.
This is a fancy way of saying that we can have multiple customers all writing
the same
SD WAN infrastructure.
So now we need to think of it not as if we're organization A but what if we're
a service
provider and we want to service both organization A and potentially another
organization over
here organization B.
Maybe we're providing the service of providing edge routers, maybe these are
tenants in a
building and we're acting as the service provider for that building so we need
to make sure
organization A which is in one part of the building or maybe one floor of the
building
can communicate to its own tenant or among its own users and yet organization B
is isolated
from organization A and even though they're all running on the same
infrastructure.
So how do we go about doing this?
Well, we're going to create another service VPN and in our case in our lab
environment
we're going to use VPN 20.
Again as long as we're not using VPN zero and VPN 512 then we are good to go as
long
as we're within the valid range.
So now I can actually create additional networks hanging off of these same edge
devices and
these will run hosts that exist in organization B's network.
So as we kind of get them into the diagram here in a variety of ways we can now
say you
know what we really have is a pair of hosts that belong to different
organizations.
So when we look back at organization A maybe we'll call this A1 and A2 and now
we'll call
organization B's hosts B1 and B2.
Because these VPNs are completely separate networks we should be able to
configure the
network to allow host B1 to communicate to host B2 and maybe we throw something
out here
eventually that's B3 and of course C becomes something like A3.
And we can create these overlapping environments if we so desire.
So why are we able to do this?
Well when we think back to when we first learned about VPNs we recall that a
VPN has
the equivalent of a virtual routing and forwarding domain or VRF.
In fact we will see VRF referenced in the CLI when we take a look at it because
we're
running on Cisco devices now and Cisco prefers the term VRF.
In fact they have said they'll be changing the terminology with an SD-WAN
altogether
but they have yet to do so.
So we're going to be configuring VPNs in manager and yet it shows up as VRFs at
the CLI.
Now an important point in all of this is coming back to the idea of what
exactly a VPN is
or really a VRF.
What is that?
It's an entire layer three domain which means that we can have many subnets
within a VRF.
We can have subnet A, we can have subnet B and we can have C and D and ENF and
so on
and so forth.
Furthermore if I have two VRFs so this is one VRF I can come over here and I
can have
the same subnet.
So I could have subnet A existing in a different VRF because it's an entirely
different routing
domain.
This is why we like it in service provider environments because now
organization A can
use a network like 10.1.1.0/24 and it doesn't have to worry about organization
B using the
exact same subnet which is really important in the world of private IP
addresses because
there's not a lot of those to go around and trying to as a service provider in
the middle
enforce some kind of sharing or NAT it just wouldn't work it wouldn't scale.
So we need these organizations to be able to use the same subnets and so being
part of
two different VRFs will allow them to use whatever subnets they want in their
networks
and furthermore they are kept separate from the other side or from the other
customers.
So in our case now B1 could be on subnet A so maybe that's the 10.1.1.0 subnet/
24
and now B2 down here which is at a completely different site it must be on a
different subnet.
This is a layer three connection that we're building and so it would have to be
something
like 10.1.2.0/24 and that would be perfectly fine because the routing will
happen by the
SD-WAN infrastructure.
So now that we understand what we're trying to accomplish namely building out
these edge
networks let's go and flip over to our lab environment and see how exactly we
want to
do it here.
So within this skill we are going to be focusing on site 11 here and edge 11
and site 12 which
is edge 12 and this is because we're using manager to push configuration down
to these
rather than using the CLI.
We'll later take a look at how to perform configuration using the CLI there
with edge
13 and 14 and this is also going to require some interesting configuration
because they're
going to be both servicing the same subnets and so that starts to get a little
bit interesting
there as well.
So either way let's focus in on edges 11 and 12.
It's just a single router at each location and what we want to do is we want to
build
out a couple of subnets at each site that belong to different customers or
ultimately
different VPNs.
So we're going to build a VPN 10 connection here so VPN 10 and rather than
configuring
routers and switches to build out an infrastructure we're just going to connect
a host to it.
This is going to be an Ubuntu server and if you've not used Linux then don't
worry we're
going to provide the configuration that allows us to use this as a host to test
connectivity
to other locations.
Specifically we're going to build out a VPN 10 connection down here at site 12
which also
has an Ubuntu host and we should be able to ping one another because we're
simply performing
layer 3 routing between two subnets that exist within the same VRF or in our
case the same
VPN.
Now we have to do the same thing at each site for VPN 20 because we want to
make sure that
our VPN 20 connections are also able to communicate across the same
infrastructure.
And so we're going to set up a pair of Ubuntu hosts at each site one will be on
VPN 10 one
will be on VPN 20.
As part of this we're going to need four different subnets.
So what subnet should we use?
Well let's go ahead and try to keep this simple we'll start them with 10 and
then from
there we will specify the VPN ID so in our case 10.10 10.20 and then this will
be 10.10
and 10.20 and then from here we can specify the site ID.
So 11 up top and 12 down here and then we'll just make this a dot zero slash 24
at each
location and the hosts will all have the same ending address of dot 50 just to
keep things
simple so dot 50 dot 50 dot 50 and 50 and these are all dot zero slash 24.
So go ahead and jot that down in your own lab environment possibly modify it to
match
your lab environment if you have a slightly different configuration.
What we're really looking for here is the ability to deploy multiple service
VPNs to
individual sites and we're going to go ahead and move over to manager to
perform this configuration.
However first we need to actually build this using more than just digital ink
here we're
going to have to actually configure our CML environment to support these Ubuntu
machines.
So let's go ahead and get them deployed and get them configured and ready for
those connectivity
tests.