One thing we need to make sure we understand is that when we're talking about T
-lock extensions,
what we're really saying is that we want to extend what exactly?
Well, we're extending the underlay, which means that we need to think about how
exactly we're performing routing as part of the underlay.
What exactly are we saying here?
So let's say we have an edge and another edge down here.
And let's just take this one transport at a time.
Let's say that we've got a transport up here.
Let's just call this the internet.
This is very similar to our lab setup.
We have a single connection coming in here towards this edge.
Now we know that this edge down here is going to need a T-lock.
So let's draw those on here.
So we have a T-lock here, again, that attachment point.
And then we have one a T-lock down here.
But what exactly are we going to do with this T-lock?
How are we going to get to it?
Well, we got to think about it from the perspective of these other devices that
are out here wherever here is.
From an internet transport perspective, they could be anywhere.
And so they have probably some kind of public IP address that might well be
subject to NAT.
It just depends on whether they have a direct connection to the internet or if
they are behind a firewall.
Or, for example, right here, we might need to consider NAT here as well.
Because what if we have a single public IP address on this connection?
Well, at this point, we need to think about the fact that I am extending this
connection, this underlay connection, down to this other edge.
Now this other edge, probably we're not going to put a public IP address and a
public subnet on here.
And yet it does need to be part of the internet.
So what are we going to do here?
Well, maybe this public IP address could actually be something like a /29.
And so now we could put an IP address down here.
That is a private IP address. So these are private IPs.
Let's just call it something like 10.100.100.0/24.
It's a private address range that's part of my network.
And yet what I'm going to do here is leverage this range of addresses as well
as NAT.
Specifically, I want to use static NAT. So we talked about NAT early on and the
fact that if we can do one to one or static NAT, that's usually going to be
best.
So now let's just make up some numbers here. Let's say I have a .3 address that
belongs to this edge.
And I'm going to use .4 on the exact same link on the exact same subnet part of
this /29.
And I'm going to one to one NAT to this with the IP address that's on this link
for this router.
Now this router is part of the internet. Now the internet doesn't know that it
's behind NAT.
It just thinks it's another public IP address here. And yet we know that it's
part of NAT, but it's also part of that underlay.
So we have performed this key lock extension. And first of all, we need to make
sure as we come back to routing that we've got routing in both directions.
So this needs to be a bidirectional conversation. So when we're talking about
bidirectional, we talk about inbound and we talk about outbound.
So in our case here, we're going to ask two questions. First of all, can this
edge out here reach this edge down here?
Well, if this edge knows how to get to the NATted IP address, the .4 here, then
inbound is working just fine.
We can allow that traffic to come in, get NATted, and then forwarded it down to
the appropriate IP address.
What about outbound? Does this edge have a route that points this way for this
device and all of the other devices?
Well, since it's the internet, it might well be a default route that gets added
in here.
Or maybe we have to get more sophisticated. If the default route points out a
different path, then we might need to insert addition or specific static routes
that point to the destinations.
So it's going to depend on our topology here. If I just have a couple of these
devices that are out here, maybe it's a hub and spoke.
So I just need to communicate with the headquarters location, back up something
like that, then a few static options might not be that bad.
But if I have to connect to dozens of sites, well, at that point, I'm ideally
going to need the default route to point out this direction, and hopefully that
works for me from a routing perspective.
So keep in mind that once again, this is part of the underlay, which means it's
part of VPN zero. I'm not directing my customer or my edge traffic default gate
ways, all that I'm not pointing all of them out this link, but I am using that
as my default route for VPN zero for the underlay.
Next, we're going to need to talk about the something private. So let's just
call this MPLS again, very similar to our lab environment. So now it's coming
into the edge. We know that we have a T lock here.
And this T lock is going to be received on a specific IP address that's part of
the MPLS network. But now up here, we need a T lock.
And it needs to be part of the MPLS network. So how are we going to do this?
Well, I could try to use the same subnet. And as long as that's a private IP
address range that can fit into the MPLS network, then maybe that will work.
However, we could also draw this way around here to get around all of our
wording. We could add a second link. So we already have one link here. Now we
have a second link between these routers.
And maybe MPLS is using some kind of 172 dot 18 dot x dot x. And we only use
subnets in this range. Well, now I can map a subnet 172 dot 18 dot maybe this
is site 17 and then dot zero slash 24 or slash 30 or something like that.
And so now we have a subnet that we can turn around and advertise into this
network. So now I have edges out here. And I want to be able to form tunnels to
this router as well as this router. How are we going to do that?
Well, the way we're going to do it is by once again evaluating inbound versus
outbound routing. And so if this router wants to form a tunnel all the way this
way, the question is, can this router reach this subnet.
And so what are we going to do about that? Well, we're probably going to have
to advertise this subnet out into the MPLS space. Many MPLS providers will
allow for BGP connectivity.
And if we're only forming direct tunnels or tunnels between edge devices that
are directly attached, we're not doing a lot of dynamic routing.
But now I do have a network behind myself that needs to be part of the VPN zero
domain. And so yes, I might have to advertise maybe via BGP. Maybe we'll do it
via OSPF service riders like BGP, but I've seen it both ways.
And so either way, we're going to have to advertise this subnet to the rest of
the network. Because again, this router needs to know, Hey, where is 172.18.17.
0/24? Where is that network? How is it learning it?
But that means, of course, that we're going to have to run BGP everywhere. The
alternative is we could also simply deploy a static route. And in our lab
environment, this is what we're going to do because we're not going to set up B
GP everywhere.
For a simple and what we're calling MPLS in our lab, not actually MPLS, it's
just a single subnet. And so at that point, we can just add a static route so
we know how to get to a subnet that's behind the directly attached subnet.
But in the real world, we might have to advertise this again, it comes back to
does the edge device out in somewhere out in the world out there, know how to
get to the T lock extension subnet.
So that's inbound. What about outbound? Does this router know how to get to
this subnet space? Because getting to this subnet space is how it can form a
tunnel back to this router.
And so we might have to deploy a static route here. Or we run BGP with this
router. And so it could be a dynamic solution like BGP. We could also run an
interior protocol. So maybe an OSPF or an EIGRP, something dynamic here.
Or again, we could just do static in a lab environment in a smaller environment
that might work fine. So anytime we're doing this, whether in a lab or in a
real world scenario, we need to think about the routing of our T lock extension
subnets.
And we need to think about it from an inbound and an outbound perspective to
make sure that the router that's forming a tunnel can reach out to the router
on the other side of the tunnel and vice versa.
[BLANK_AUDIO]