All right, here's our current setup for VPN 10.
We have our hosts on the left.
This is .11.50, .12.50, .13.50 on the right.
All these hosts can ping one another fine.
And the reason for that is because we have a lot of redundancy in place and
just flat
out SD-WAN connectivity.
So we have, for example, edges 11 and 12 are able to form connections to the
internet
and form tunnels to edge 13 in this fashion.
And then we also have connections through the MPLS cloud, which notice we've
got redundancy
configured between edges 11 and 12.
If the internet were to go down, then we can communicate through MPLS.
And vice versa, if MPLS goes down, we can communicate through the internet.
So we should see that these two hosts over here can communicate no matter what
happens.
Edges 13 and 14 are built a little bit differently.
So what exactly is the problem here?
We know that if edge 13 goes down, edge 14 stays online because of VRP, we have
connectivity
to the site because of OMP, we have connectivity upstream.
And so we have full connectivity still if edge 13 were to go down.
Now we did see this problem.
If edge 13 were to lose its internet circuit, it loses both of its IP sec
tunnels.
And we do have this problem where our hosts are using edge 13 as a default
gateway.
But we can tune VRRP such that edge 14 would then take over at that point,
which is the
concept of FHRP tracking.
And it's a concept that's covered in a great amount of detail elsewhere in CBT
nuggets,
especially within some of the more CCNP types of tracks.
But in this case, we're not going to use tracking, we don't need it.
And we're not going to go into the details because of what we want to talk
about with
T-Lock extensions here.
So the, I guess what I'm trying to say is that whether edge 13 goes down or
even if
edge 13 loses its upstream connections, we don't need T-Lock extensions to stay
online
through edge 14.
So what are T-Lock extensions really built to accomplish?
Well think of it like this.
What happens if everything is in steady state operation here?
And we have a bunch of devices down here that are using edge 13 as their
default gateway.
Well what happens is as we've already said, everybody is able to get out
through edge
13.
Well, if edge 13 is receiving all of the traffic and it's all destined for
something over here,
which circuit is edge 13 going to use?
Well it's always going to use the internet.
And at first glance we'd say well from a connectivity perspective, everything
stays up and everything's
online and we're good to go.
However what about the situation where now I have a phone or maybe a soft phone
client
here on the laptop and based on DSCP values, I'd really like to use not edge 14
specifically
but the MPLS circuits that are attached to edge 14.
Does edge 13 have that capability and the answer is no.
This is not possible because all of this traffic is still going to land on edge
13 and edge
13 does have an internet connection but it does not have an MPLS connection.
Could we in some weird way make it so that this traffic lands on edge 14 so it
can go
out the MPLS maybe but that's starting to introduce all kinds of complexities
into the
network and we're trying to make our SD-WAN as simple as possible.
So what do we want to do here?
Well we keep mentioning the concept of the T-Lock extension and so we're
leading towards
the idea that we want to extend the T-Lock and more or less a give edge 13 and
MPLS connection.
But it's important to understand what it is we're trying to accomplish here
also from
an SD-WAN perspective.
Remember SD-WAN says that we have a particular network and that is the underlay
.
What we have is a single circuit connection to edge 13 and that gets
represented by a
T-Lock and what we have is a single MPLS connection which is represented by a T
-Lock
on edge 14.
That is what we have but what we want is what we build with the overlay and
building
out tunnels via the overlay should be possible no matter what we have in the
underlay so
long as we have full layer 3 reachability.
Layer 3 allows us to route in all kinds of different directions and so if we
have layer
3 in place I should be able to build a tunnel.
So the idea here is could edge 13 build a tunnel using the layer 3 network that
exists
and connect out to edge 12 and connect out to edge 11.
This is what we want to accomplish.
We want to accomplish that but notice there is no T-Lock here.
I need a T-Lock in order to form tunnel connections and so now hopefully we're
starting to glue
the pieces together here.
I want to create a consistent overlay.
I want edges 13 and 14 to each have tunnels through both circuits but what I
have is an
underlay that at first glance doesn't appear to support this.
So what do we do?
Well we recognize that we have a layer 3 network and we can take advantage of
this.
So we can create a T-Lock here that points out the MPLS to the MPLS world and
we can
create a T-Lock here on edge 14 that connects us out to the internet.
And so now I can start to form my tunnels this way and I can start to form my
tunnels
this way.
But at least that's what we want to accomplish.
And that is indeed when we start talking about these T-Locks for not directly
connected links
this is where we want to talk about the T-Lock extension.
Now the only question is how?
How do we build out the T-Lock extension?
What links are we going to use?
For that matter what VPN are we going to use?
We've got some questions to answer here as far as how we're going to build out
the T-Locks.
Also what subnets are we going to use?
So can we use existing links?
Can we use the subnet that we have here?
All of these questions we have to still answer but what I really want us to
take away is
the fact that there are inefficiencies that are caused by having only a single
internet
circuit.
Not only are there inefficiencies there's also inconsistencies.
So now some big words here.
What are we saying?
Well we're saying that if I want my traffic to be able to be sent out two
different directions
then we're going to need to set something up so that edge 13 has tunnels out
both circuits.
So that's the inefficiency side.
The inconsistency side is hey I want every edge to have a link to the internet
transport
and a link to the MPLS transport.
And this is great for again edges 11 and 12.
These are good to go but 13 and 14 don't have this they are inconsistent with
the topology
that we desire.
We want to force these into this topology even if they don't have direct
circuit connections.
So let's go ahead and resolve our inefficiencies, resolve our inconsistencies,
deploy some T-LAC
extensions but also start to answer some questions about how we go about doing
it.