We had a slight error in our configuration in the last video.
I configured MPLS as a T-lock color, but we actually need that to be restricted
.
Remember, we've configured the color MPLS to be restricted everywhere, but that
is a
per device setting.
That's nothing you can set globally, unless we're managing it via a template
that just
pushes it everywhere.
In our case, we're doing a VSCLI.
So it's a device-specific configuration, and in order for it to understand that
it's
kind of advertised this as being restricted, well, we have to actually
configure that.
And so if I do a show SDWAN run and then pipe, and this is a great one, if I
can say include
a couple of parameters, I can include gig, and I can include color, both
together they're
using that pipe command, we can get an output from show SDWAN run that just
shows the interfaces
and then importantly down here along with the colors.
So we see interface gig 4.14 here on edge 13, so this interface here, which is
part of the
MPLS color, that's correct, but we do need to add restrict.
So let's go ahead and go do that real quick.
We'll just get into our config dash T, SDWAN configuration, gigabit ethernet
with a capital
G. The SDWAN part is a little bit finicky with some of those things, and then
we get onto
the tunnel interface, and we do color MPLS restrict.
And then I can commit.
Now just another little CLI trick here, if I do a show, I can do a question
mark and
see, whoops, well, hold up.
Let's exit out tunnel interface here and do a show question mark.
Well, it's still not working.
Show SDWAN question mark.
All right, so before I was working show full dash config, there we go.
Okay, I'm not sure why the question mark wasn't working, but either way, we're,
like I said,
the SDWAN part is a little finicky at times.
I was going to show the options that are there, but the command still took.
So show full dash config shows us the configuration.
So we can see for sure that the color MPLS restrict took just fine.
So now I can do end to get all the way back out.
If I wanted to run that same command, show SDWAN run with the include commands,
we can
also verify that MPLS restrict took, but on the off chance that something went
wrong,
it's nice to know before typing the end command and backing all the way out.
All right, so now the configuration is set based on the last video, our under
lay is fully
extended.
So let's go ahead and go over here to edge 11.
Now looking at our diagram here, edge 11 is way out here somewhere.
Try to get it in the screen.
There we go.
So edge 11 is out here and it's part of both of our underlays.
So we've got the 254 underlay, which is MPLS, maybe I'll just write that in
blue.
So we know that that's MPLS.
So in 192.168.254 is the MPLS domain.
And then the internet domain is 192.168.255.
And so we have extended the underlay by not only creating layer three
interfaces, but
also by configuring static reps.
Now we might have wanted to do that with dynamic routing in the real world.
We might choose to do that, for example, but the internet in our environment,
again, being
a fake internet, is this .255.
But we should be able to ping these addresses.
So let's go ahead and see what we got.
So edge 11 should be able to ping 192.168.255.
And then let's just take a look at edge 13, which is on the internet itself.
Okay, good.
And now let's go ahead and ping some of those new subnets.
I'm going to ping 10.13.13.1, which is also edge 13.
And now I'm going to ping .2.
So I can reach the .13.13 subnet.
So that's good.
And we know that traffic is getting there, but why isn't this ping working?
That's kind of interesting.
Well, that's because we haven't configured our T-lock extension yet.
So if we think that because edge 14 has a T-lock configured here for the
internet, if we think,
okay, let's good.
Now edge 11 can reach out through this and come down that we might expect that
that would
work.
But we haven't actually configured the T-lock extension here on edge 13.
And so what exactly is happening?
Well, number one, we can't even ping this because we're not allowing pings to
go through
the tunnel interface.
And really, that would be more of an interface here.
So this is that .11 or .13.
I ping .13.
Okay, good.
I did ping .13.
So get rid of it.
There we go.
.13.
And we can't even see that on the screen.
.13.
And it's on there.
All right.
So we can ping .13.
We can ping 10.13.1 right here, but we can't ping .2 right here.
And the reason for that is not that edge 14 doesn't have a route back.
If we check the edge 14 routing table, we will see that right here.
Let's go ahead and log in and do a show IP route.
Let's do that one more time without a log message in the middle of it.
And we see that we've got this subnet in our routing table.
And because of the static route pointing to .11, we know that edge 14 has a
path back.
The problem is that the ping is not even making it to edge 14 because of all of
the reasons
that we've talked about.
Furthermore, if I were to do a show SD-WAN BFD sessions, notice we have our
four interphase
or our four BFD sessions or four tunnels, essentially, that if we look at our
diagram
here, we know that.
Let's see here.
Let's grab a green color.
All right.
So we know that edge 11 has two connections to 12, one through the internet and
one through
the MPLS.
And then we've got one going to 14 via MPLS and then one going to 13 via Biz
internet.
All right.
So those are the four tunnels.
But this is a T-lock down here, edge 14 has a T-lock that it should be
advertising.
So why isn't edge 11 showing it in this list?
Even if it wasn't able to come online, it should understand that there's a T-
lock out
there that it's trying to reach out to.
Well, the reason for that is because we're not actually allowing the T-lock
advertisement.
I can check OMP and say show SD-WAN OMP T-locks.
This is a great command.
And I can see the T-locks that I'm aware of.
Remember, T-locks are attachment points.
And as long as the T-lock doesn't have a restriction on it, I should be trying
to reach
out to it.
So I see my own T-locks here.
I'm edge 11.
I'm running this from edge 11.
And so T-lock entries for 11.11.11.11.
I love that it has all the dashes up here because it allows me to space through
and see the
next one here.
And so this is the next entry for edge 11.
So last one is for MPLS.
This one's for Biz Internet.
The space down again.
I see 12 has one out MPLS.
I should see another one for 12 out Biz Internet.
So that explains why I have two connections going to edge 12.
And then I see edge 13 attached to the Internet.
So we know that 13 is attached to the Internet.
And then we see one for 14 that's attached to MPLS.
Now what is this?
This is, remember, edge 14 has that extra Internet circuit that we put on a
different
color set to restrict.
And so we're not even trying to form a connection to this T-lock because it's
on a restricted
color.
And that's just so that edge 14 again can reach the control points.
So that's it.
We don't have this T-lock.
Even though it's configured, it's not being advertised through OMP via the V-
Smartr controller.
And so let's go ahead and configure the T-lock extension.
But I did want to start, there we go, just doing some log messages there.
But I did want to start by taking a look at why we need the T-lock extension
even with
the underlay fully configured.
So let's go ahead and configure our T-lock extensions.
We'll start with edge 13.
I'm going to do a config-t and get into the SD-WAN configuration.
From here I need to get onto my interface.
So interface, now for 13, the extension's right here on gig 4.13.
So I have to be very careful to make sure I'm on the right interface, 4.13.
And now I say T-lock dash extension and then I specify gigabit ethernet 1.
So gigabit ethernet 1, it's not on our diagram here anymore.
I accidentally erased it I think.
But it was the layer 3 interface going out to the internet.
So I'm going to hit enter here and say commit and end out of that.
Now let's go to edge 14 and do the same thing, but on a different interface.
So config-t, SD-WAN, get onto the right interface.
So I'm looking at edge 14.
The T-lock extension goes out gig 4.14.
So gigabit ethernet 4.14.
And then T-lock extension and I can tab this over and we are extending it to
again gigabit
ethernet 1.
Hit enter and I forgot to commit.
So let's just say yes, let's commit them.
And we should be good to go.
So now we want to take a look and see what's going on on all of these other
devices.
So remember we just ran some commands.
Let's do a show SD-WAN BFD sessions.
Now things are still propagating, but take a look right away at the very top of
the list
we see that we have a connection to edge 13 and it's via MPLS.
We didn't have that before.
We have this one, edge 13 connecting to biz internet, but not edge 13
connecting through
MPLS.
That means that edge 11 up here in our diagram is going through MPLS to get to
edge 13.
That should also mean in theory that if I do my show SD-WAN OMP T-locks, that
now edge
13 should be advertising to T-locks.
So we get down to our edge 13 section, edge 12, edge 12, edge 13.
There we go.
So look at that.
We're going to get a picture for edge 13 now via MPLS.
We didn't have that before.
We only had one here via biz internet.
Now let's look at 14.
14 is via MPLS.
That's the original one because 14 has always had an MPLS connection and then
the red connection
we know.
So why isn't edge 14's T-lock being shown here in this list?
Well, a big part of learning SD-WAN is to try to figure out why tunnels are
informing
when we want them to form.
And we start at that layer.
We say, OK, well, why wouldn't a tunnel form?
Well, if a tunnel's not forming, we need to first of all figure out if there's
a T-lock
there.
If a T-lock is being advertised, maybe the color is set to restrict.
That kind of thing could be a factor.
But if the T-lock isn't being advertised, we really need to dig deep and think,
OK,
why wouldn't a T-lock be advertised?
Maybe there's a layer 3 issue.
Maybe there's a problem with the interface.
And so that could actually cause problems with the tunnel not forming.
If the T-lock is being advertised, but it can't reach it.
Or potentially, I just don't have that interface online or something along
those lines.
What's tripping up to us up here in all likelihood is if we think way back to
the situation where
we're advertising T-locks on an interface, and this device can't actually reach
control
components because it's going a different way.
So we say, well, edge 14, why can't it reach the control components out the
internet?
Well, that's because edge 14 is using its own internet circuit to reach control
components,
which means it can't actually reach V-Smart and V-Bond and V-Manage out this T-
lock based
interface.
That is why the T-lock is not being advertised.
And so, again, we just have to start to think through a mental checklist of, OK
, again,
start with the tunnel.
If the T-lock is there and the tunnel is not forming, explore restrict options,
explore
layer three issues, but if the T-lock's not being advertised, now anything
about why
the T-lock might not be advertised, and certainly a big reason for that is if
we can't form
connections out that interface to our control components.
So let's go ahead and flip over to edge 14 here and do a config-t.
We'll get on to SD-WAN and get on to our interface.
Let's try to remember what this command is here.
So, again, make sure, first of all, we're on the right interface, check our
diagram, get
on to the tunnel interface, and now we're going to use that max control
connections command.
We have to say that there's zero expected control connections, and we'll go
ahead and
commit.
So at this point, let's go ahead and back out of this.
And we want to now check to see if we are advertising T-locks, at least if we
're even
aware of this.
So we're going to go ahead and base it all the way through here.
And we're going to get to the point where we are seeing T-lock entries for our
edge
14.
And look at this.
Now we're advertising one for Biz internet, which is awesome.
So now let's go ahead and flip back to edge 11 here.
And we're going to run our show SD-WAN BFD sessions.
And look at that.
And now we have a connection here to edge 14 out both the MPLS and Biz internet
.
So at this point, we have full connectivity.
We've got our T-lock extensions working.
We have tunnels now going everywhere in the environment.
It's time to perform some failover tests, make sure that everything is working
like
we think it's working, make sure all of our tunnels are functional, especially
in the
event of a failure, which is part of the whole reason we did this was to make
sure that redundancy
would work effectively at a dual edge site like we have with edges 13 and 14.