Alright, let's have some fun. We're going to pull up a couple of topologies
here and
answer some quiz questions based on it. So the questions are listed in a depth,
so go
ahead and take a look at those if you haven't already. I would encourage you,
as always,
to sketch out this topology or these topologies on a separate piece of paper
and answer the
questions as best you can before reviewing the solution. So here we're just
going to
jump right in and talk about each question and what the answer is for each one.
So start
off here. Number one, what VPN is configured on the controllers for
connectivity to the
internet? I've brought this up a few times because I really want to emphasize
the point
that our tunnels are built on VPN zero. So when we're talking about the
connectivity
to the internet here, that is the connectivity point that we're going to use
for forming
tunnels to the other devices, whether other edge devices or other controller
devices,
either way, is going to happen on VPN zero. Just keep that in mind, because VPN
512 is
going to be back here. And it's going to allow us as admins, as we've said, to
perform
logins and to perform management of these different devices. And we might look
at that
and say, Oh, okay, so maybe this is where we're going to form our tunnels to
one another,
at least among the controllers, even if we use VPN zero for the edges. But that
is not
the case, we're still going to use VPN zero for our tunnels among the
controllers. So
always, always, always form VPN, or form tunnels on VPN zero. And that means
that the
links to our ISP one here, this internet link, because these devices exist in
the cloud in
this scenario, those will be on VPN zero. Now number two, what colors did you
assign to
the two different internet transports? This to be clear has no objective answer
, other
than making sure that we're choosing public strings or public colors. Because
we're actually
on the internet, we don't want to call these private networks. And so the only
ones that
we can't use would be MPLS and Metro Ethernet. Those are our private ones, as
well as anything
starting with private so private one through six, those are out as well as long
as I didn't
choose any of those, we should be fine. Now what you choose is up to you
because we map
the value to the different public strings or public colors. So I could call
this one on
the left biz internet, and the one on the right public internet. But you might
look at
that and say, well, what if I put public on this side and biz on that side?
Well, fine,
it doesn't matter because we map the value to it. You could also have gone with
something
like I'm going to call the ISP on the left red, and the one on the right green,
we have
red green blue. Maybe this is a better internet. And that's why our controllers
are connecting
through it. And so I'm going to call this my gold color and the ISP on the
right my
silver color. We could choose whatever it is that we desire here. So again,
there's no
really objective wrong answer as long as we didn't choose a private color for
either
one. Next question, how many data plane tunnels will be formed in this
environment by default?
Oh boy, this is a fun one. So how are we going to answer this? Well, a couple
of things.
First of all, remember that when we have T locks, those T locks are going to
try to form
connections with every other T lock that's out there. These are our attachment
points
as we've said. And so I'm going to certainly form tunneled connections this way
and this
way. And we might originally think that that's all that's going to happen.
Because when we
look at it, it appears that these networks are air gapped, except this is the
internet,
which means that by the definition of the internet, these two ISPs are
connected to one
another. So because there's this inherent connectivity between them, this T
lock up
here on edge 100 is not only going to reach out to the left edge on 101, but
also the
right or the left T lock on 101, but also the right T lock as well. So we're
going to
form four different tunnels by default. We're going to have a full mesh of
connectivity,
even bridging from one color to another color, let's say from biz internet to
public internet,
for example, that's no problem at all from a SD WAN perspective. And again,
that might
defy our initial expectations. I might think that I'm only going to form tunnel
ed connections
out the same color from from one T lock of one color only to T locks of the
same color.
Now we can configure it that way. We've seen that we have options for doing
that, but by
default, we're going to form connections to every single option that's out
there as long
as we can get to it. And we're really going to try to form those connections
unless we
do something. So if we're doing show BFD or show SD WAN BFD sessions, we might
see that
connections are down. And we're like, well, I don't even want you to try to
connect to
that. Well, it's going to try to connect until we tell it not to even try. And
so we
might see a bunch of connections that are down in our SD WAN environment. And
that's
because maybe in our case, or in that case, these tunnels can't actually form.
There is
an air gap between them, but you know, it's still going to try to connect from
one T lock
of one color to the T lock of the other color. And that leads us to our next
question here.
So if these are all in place, we say what color based configuration could be
applied
to limit these tunnel data plane tunnels to two, we want to essentially get rid
of these.
Well, this is where we could apply the restrict command. So I could apply a
color and I could
say restrict. And I really only have to do that on one side if we have two
colors, because
now this T lock is not going to try to connect to this restricted T lock down
here. And in
the same way, our bottom left color is not going to try to form a connection up
here.
It's going to say, Oh, whoa, that's a restrict. I'm not even going to try to
connect same
thing this way. Oops, I'm not even going to bother trying because they're both
set to
restrict. Now, if I have a third transport in here, maybe I need to set all of
these
to restrict. But in general, we see that restrict is going to help us out here.
So data plane
and control plane tunneling functionality, very important for us to understand
how these
tunnels are formed, where the tunnels are formed, and what we can do to control
that.
[BLANK_AUDIO]