All right, we're going to wrap up this quiz with four more questions.
Let's go ahead and get started.
Number one here, what are the three components of a T-lock?
We always need to keep in mind that a T-lock is simply a three tuple of
information.
First and foremost, it is a system IP address that identifies who the T-lock
belongs to.
This is not necessarily a routable IP address.
I'm not using this IP address to get to the T-lock.
As we've discussed, we are going to get a T-lock rout later from V-Smart, which
tells
us how to get there.
This is simply a system IP.
Like in our environment, we've got 11.11.11.11.
That's a loopback IP address on edge 11, and it simply identifies the device in
the same
way that we might identify an OSPF device by having a router ID.
That's what the system IP is providing for us.
Number two, the color.
We spent a lot of time on the concept of the color.
The color essentially helps us to identify the transport network.
For example, are we connected to Internet service provider one?
Are we connected to Internet service provider two?
Are we connected to an MPLS network?
The color is a string that is arbitrary.
We get to decide the significance outside of the fact that there are public and
private
colors.
We do need to understand this concept, and we'll talk about that in a little
bit.
Number three is the encapsulation.
The encapsulation basically tells us are we running IPsec tunnels or are we
running GRE
tunnels?
The vast majority of production networks, we're going to run IPsec because one
of the
values of SD-WAN is to secure the data plane.
Before SD-WAN existed, if we had MPLS, most organizations weren't encrypting
that.
If we're going across the Internet, we'd use something like IPsec, but if we
were building
an MPLS network, very seldom, at least in my experience, did I see
organizations securing
MPLS connections at the data plane?
The fact that we can specify IPsec in here as part of the T-lock, that allows
the device
to know how to build the tunnels out to this device.
This three tuple of information serves as what we have called an attachment
point.
It is not to be likened to a layer three interface or any other traditional
network construct.
It is basically information.
It's saying, hey, this is an attachment point and if an edge sees that there's
an attachment
point out there, a T-lock out there, as long as I have no other rules in place
telling
me not to connect to it, I'm going to try to connect to it.
If I have multiple T-locks, I'm going to try to connect to it from all of my
existing T-locks,
which is why we can get so many tunnels in the environment.
But understand that that's exactly what we're talking about with a T-lock.
It is that attachment point and is very critical of a concept that we
understand as we move
deeper into SD-WAN configuration.
Question two here.
Aside from the private colors, private one, private two, etc., all the way up
to private
six, which two other colors are private?
I told you we were going to talk about it and now we're talking about it.
Okay, so which other ones are private?
Well, it's simply going to be MPLS and Metro Ethernet.
It is Internet LTE, all these different colors, red, blue, green, as well as
bronze, silver,
gold.
Those are known as public colors.
So what is the difference?
Well, hey, you know what?
Rather than talk about it, maybe we should have a quiz question about it.
So we'll talk about it here in the next quiz question.
But it is important for us to recognize there are a whole lot of colors.
They have all been predefined by Cisco.
So we don't get to create our own colors, even though they're strings.
I can't create my own Internet dash three or anything like that.
I have to use one of the pre-created, predefined color strings and they are
split into public
and private.
Fortunately, there's not a whole lot of private ones out there.
We just have to remember that MPLS and Metro Ethernet are the private colors as
well as
private one through six, which gives us plenty of options if we need more
colors.
Well, I'll tell you what, one quiz question leading to the next is leading to
the next.
As promised, here's our quiz question about public and private in which
scenario is the
public IP address used to connect to a T-lock.
So when it comes down to the difference between a private and public T-lock, it
has to do
with what IP address I'm going to use to connect to a T-lock.
And we've already said that a T-lock doesn't have a routable IP address in it.
And that is true.
However, what we are going to eventually cover in more detail and we've alluded
to this is
the fact that if I as an edge want to reach out to a T-lock, I'm going to have
to rely
on VSmart or the controller sending me a T-lock route.
This T-lock route is going to include a lot of critical information, including
the public
and private IP address of the device I'm trying to attach to.
Now keep that in mind.
We've got a private IP address, which are those private RFC 1918 addresses, as
well
as a public address, which is something that's publicly routable on the
internet.
In some cases, these will be the same entry because not every edge device is
behind NAT.
But if we do have NAT involved, then the private is going to be some address A
and the public
will be IP address B. It'll be a completely different IP address.
So now we're asking the question, which scenario is the public IP address?
So this IP address B here, when am I going to use that to connect to a T-lock
versus the
private?
Well the answer here is A. One or both colors are public.
So what we're essentially saying is if we have a private color connecting to a
private
color, so something like MPLS connecting to Metro Ethernet or maybe we have two
MPLS circuits
and one is called MPLS and the other one is private one, something along those
lines,
well at that point we would use the private IP address.
But this is the only scenario that we're going to use the private IP address.
As soon as one side is public or the other side is public or both are public,
at that
point we will use the public IP address to try to connect.
Now also notice that this is really telling us that if we have two different
colors, we're
actually forming tunnels between them in this scenario.
This is primarily when it matters.
Do we want tunnels formed between two different colors?
Maybe yes and maybe no.
So that's a conversation to have with the design team as we're designing the SD
-WAN network.
We have to decide how many tunnels that we actually want.
But in the scenario where we are forming tunnels from one color to another
color, that public
and private property is going to matter significantly and it might even affect
whether or not a
device is reachable based on the way that we're routing our private and public
IP addresses.
Okay, we will wrap up with this question.
Which NAT type is the most restricted?
Now I'm not providing a whole lot of information here, and I'm just asking
which one is the
most restricted and the answer is going to be B-symmetric NAT.
Symmetric NAT sounds, I don't know, the word symmetric doesn't sound too bad to
me.
Something like restricted or port restricted sounds even more restrictive than
something
like symmetric.
But symmetric is akin to the concept of port address translation or pat in the
Cisco world.
Whole cone NAT, this is the concept of static NAT which allows us to have a
true one to
one relationship.
Restricted cone and port restricted cone get a little bit more complicated, but
they're
not nearly as restrictive as symmetric NAT.
Symmetric NAT is really bad because if we are using PAT, bad from a
connectivity perspective
I should clarify, it's really bad from that perspective because the port gets
randomized,
it gets scrambled.
And so we have no idea what device is reaching out because not only is the IP
address scrambled
or changed but the port is also changed.
And so the most restrictive situation is if we have two edge devices behind PAT
, both
of these are going to have their IP imports changed and it makes it so that we
are not
able to form a connection.
Now there are a whole lot of caveats to all of the NATs we talked about in
great detail
here in this skill down here at the bottom about the different types of NATs
and we even
link to Cisco document which talks about which devices are unable to
communicate with
one another.
Fortunately for using IPsec, this is the only scenario we need to worry about.
Every other scenario we can make connections happen.
If we have GRE, however, it is a different scenario, according to Cisco
documentation,
there are some other configurations that will not work.
And so generally speaking, if we have PAT out in the environment, we are
probably not looking
to make a full mesh of tunnels, we are probably going to do something like a
hub and spoke
or something along those lines or at a minimum a partial mesh.
And so it's all part of the design process for us to look at what edges we will
be using
NAT, what edges will not be using NAT, and to try to make our tunnel design
based on the
information that we have.