The concept of T-lock extensions is going to build on the concept of the T-lock
, which
once again is really more of an attachment point than it is an IP address or
any kind
of traditional network construct.
This attachment point concept is very important when we then apply it to the
concept of the
T-lock extension, which allows us to create an attachment point that isn't
directly attached
to, for example, the internet or having a specific MPLS IP address.
So this becomes very clear when we start to draw these T-locks here and we say,
"Hey,
I've got this T-lock that once again allows me to build tunnels out the
internet."
But again, this T-lock is not directly on that interface.
It's just again an advertised attachment point that says, "Hey, you can attach
to me."
And then the T-lock route tells people how to attach there.
But because this T-lock is associated with a color, in our case we're using
blue to
represent the internet, in our lab environment we're using Biz internet as the
color.
But either way, we see that this T-lock is just an attachment point.
So now I could actually say that, "Hey, I want to build a T-lock with the Biz
internet
color and allow me to form tunnels through the internet this way."
There's no reason why I can't advertise an attachment point for devices that
are out
here, like Edge 11, that's hanging out here, that build a tunnel to Edge 13
through the
internet.
Why couldn't it build a tunnel across a Layer 3 infrastructure that allows me
to get to
Edge 14 if it's advertised through Edge 13?
This is the concept of the T-lock extension.
I need to build some kind of network, some kind of connection between these two
routers
that allows for it to be Layer 3, and allows for Layer 3 routing and
advertisements of
routes.
And now we see that we have a path for Edge 11 to go through Edge 13 and attach
to the
T-lock that exists on Edge 14, that is being advertised as part of the internet
.
Now likewise we want to do this in the other direction.
So Edge 14 has a T-lock that allows for Edge 11, for example, to form a tunnel
through
the MPLS circuit.
I'm coming to Edge 14.
Well likewise now I would like to build a T-lock on Edge 13, that's part of the
MPLS
color, that's also going to participate somehow in the Layer 3 network and
allow me to build
tunnels through Edge 14 to get to Edge 13.
Now this looks a little bit complicated when we look at it from an underlay and
overlay
perspective.
So what exactly is happening here?
Well when we draw it out very simply, Edge 11 is down here, yes Edge 12 is
involved, but
just to keep things tied to what we just drew here, we have Edge 11, 13 and 14,
and we're
going to build tunnels out via the internet, and so we're going to build
tunnels this way,
and we're going to build tunnels this way.
It doesn't matter what the underlay is, so long as the underlay supports these
connections
from a Layer 3 perspective.
So we're building a very consistent apology here, if we wanted to add Edge 12
into the
mix, now we're talking about being able to form tunnels everywhere and very
cleanly building
out a topology that is symmetrical or otherwise very efficient, as well as very
consistent.
Notice how beautiful this drawing is, yeah this is a little bit complicated
because it
involves underlay connections and we have to worry about that on some level,
but again
this is the overlay, this is what we want.
Now as a brief sub note here, we'll notice that we didn't actually form
connections between
Edges 13 and 14, and that's intentional, that's because they share a site ID.
So with the same site ID as in use, this is site 13, and so the SD-WAN
environment knows
not to build tunnels, and I should really say the edges know not to build
tunnels to
other edges that are part of the same site.
There's no reason to do so, and as a result we maybe look at that diagram and
realize
there's a couple of links missing there, but that is actually a good thing.
So let's answer a few questions here, what exactly is this layer 3 connection,
and for
that matter is it a layer 3 connection?
Well we know we have to establish layer 3 in some capacity, but we could just
build a
layer 3 interface and a layer 3 interface and connect it directly or connect it
via
layer 2 switch.
So let's talk about that.
What does the connectivity look like between our edge devices?
So first of all, the ideal solution in most cases is to have a direct
connection.
If we have a direct connection, then I just have a cable between the two edges,
and I
establish an IP address on this side, an IP address on that side, and they're
able to
communicate with one another.
However, they can run through a different connection if needed.
For example, we could have a layer 2 switch in between, and then we just need
to make
sure that it's part of the same broadcast domain or the same VLAN so that we
can build
our connection on a single subnet.
However, there is a place where we could have a layer 3, I'll just say layer 3
device,
because it could be a layer 3 switch, it could technically be a router, and if
this is the
case, this is going to require a little bit of extra configuration.
This is going to require GRE tunnels to be established because they still need
to see
each other as being direct.
We're just going to use tunnels to do it, and now we're talking about tunnels
on top
of tunnels.
So this should not be a common design, and usually if we're talking about a
dual edge
solution, those devices are usually in the same physical space, so there's
usually not
a problem with establishing either a direct connection or a connection through
a layer
2 switch.
This is really a corner case type of scenario, and not one that we expect to
see very often,
but at least we know that it is an option.
So that's the physical connectivity, but there is one other thing to consider,
and that is
the fact that we do need two different subnets or different connections, really
, per T-lock
extension.
What we mean by that is we've drawn a single layer 3 link here, maybe that's
good for the
internet one, but we might need another layer 3 connection to support the MPLS
connection.
And this has more to do with our layer 3 routing, and we'll see this in our lab
coming
up, but it's likely that we will need two different layer 3 networks, one
reserved for
one T-lock extension for one direction, and one reserved for the T-lock
extension in the
other direction.
Now maybe we only need one T-lock extension, but that's a whole other
conversation, certainly
something that is going to depend on the site topology.
So that is our physical connectivity.
What about the logical connectivity here?
Well again, we need a layer 3 interface, and there are several ways to get a
layer 3 interface.
For example, we could have a physical interface as we have drawn here, where I
've got a physical
connection going to another physical connection, and the IP address exists on
the individual
interfaces.
However, we could also have a sub-interface configuration, which saves on our
connections.
What do we mean by this?
Well let's say that we've got an edge device, and we only have one physical
port remaining
on each of these edge devices.
And I just said that we need a different subnet for each T-lock extension.
So I need two layer 3 interfaces, only have one physical left.
What can I do here?
Well I could build a trunk link between the two, and this is likely going to go
through
a layer 2 switch.
So by putting it through a layer 2 switch here, we can now split this off into
two different
sub-interfaces, and allow us to route across both layer 3 links using a single
physical
connection, which is carrying VLAN tags.
So we might assign VLAN tags of 100 and 200, and so when the packets come
through with a
specific VLAN tag, the routers know which interface or sub-interface it belongs
to.
So sub-interfaces are certainly an option.
Now at the time of this video, we might want to know about a loopback.
Could we just use a loopback interface, and the answer is no.
Loopbacks are not supported with T-lock extensions at the time of this video.
It's entirely possible Cisco decides to support this down the road, so check
your documentation.
But it's likely that we're not going to see loopbacks anytime soon.
So we're really talking about either a physical connection or sub-interfaces,
either way it
does have to be a layer 3 interface that we're using to build the T-lock
extension.
Now next up, what VPN is this going to be a part of?
And the short answer is it's going to be part of VPN 0, which at first glance
we might say,
"Well, that's too bad because I have this whole connection I built out.
It's a layer 3 connection.
It's part of VPN 10."
And I could establish routing across from one router to the other and build a T
-lock extension
that way.
But that doesn't make sense as much because again, VPN 10 is part of a
particular customer's
network and we don't want to be building underlay connections across a part of
the network that's
not built to be the underlay.
Remember, VPN 0 represents the underlay and therefore a T-lock extension is
going to be
a part of the underlay.
And that should make sense when we really unpack it because whether it's a
physical connection,
like an actual circuit coming in or whether it's simply a layer 3 network link
that's
part of the underlay, either way, when we color this out, we should see that, "
Hey, yeah,
that makes sense that this is all part of the underlay and we're building our
tunnels
across the underlay."
So yes, this is going to be part of VPN 0, which means we cannot repurpose or
reuse some
layer 3 interfaces that we've built out that are part of other VPNs.
So that is the gist of the design elements that we need to take into account
when it
comes to our T-lock extensions.
For simplicity's sake, the best thing we can do is to just build two different
connections
here.
Two different direct connections between edges 13 or between our two edges,
regardless of
what their names or numbers are, but we need to build out to maybe two
different direct
connections.
We could possibly take advantage of subinterfaces if we need to, but the exact
topology is going
to depend on what exactly we have at a given site.
So always keep that in mind in the real world.
For our lab's sake, we're going to have to log in and see what exactly we're
going to
in order to build out these T-Lock extensions.