All right, back to our usual view here.
So we've got our topology right above me here,
and what we're gonna do is we're going to
log into Edge 13 here, so I'm on Edge 11 right now.
If I do that show SD-WAN OMP routes,
this is gonna be a little bit more messy,
but we'll try to point out what matters here.
And you can see why I was using the other view
for the previous video.
But what we see here is if I look at this subnet right here,
10.10.13.0, we see first of all over on the right
that it says C, I, R, and furthermore,
it does show that I have four of these.
If I highlight it here, we can kind of see
a little more clearly in the mess
that we've got four different paths all using IPSec.
Right here, these are actually, again, shifted way over.
These are the TLOC transport,
so these are the different colors that we're using.
But we do see that we have four different paths,
and if you really wanna stretch your vision a little bit,
this 14, and then it extends over here.
So 14.something and 13.something,
well, it finishes off over here.
So we can tell that there's two paths through Edge 14
and two paths through Edge 13 over on the right.
So again, a little bit messy,
but we wanna see what ends up happening here
once we play around with things.
If I do a show IP route vrf10, that's a little cleaner.
We see that we've got one path going to site 12
and two paths going to site 13.
Again, knowing on the back end
that each one of those represents
actually two different SD-WAN paths.
So what we're gonna do is get onto Edge 13,
and what we're gonna do here is do a config-t
and get into SD-WAN configuration,
and then get onto my interface, gigabitethernet1.
Now, Edge 13 right here,
that is the biz internet interface for Edge 13.
It's MPLS interfaces, that TLOC extension
that goes through Edge 14 down this way.
But what I can do is get onto the tunnel interface,
and interestingly, Cisco includes
the TLOC preference command alongside encapsulation.
So when I say encapsulation ipsec,
before we just hit enter,
if I do a question mark,
we see that I can set TLOC preference as well as wait.
Both of these are part of the TLOC routes
that get advertised.
So remember, wait is for the sake
of unequal cost load balancing,
sending more traffic to one path
and a little bit less traffic out another path, for example,
as opposed to either balanced or not balanced at all.
But either way, now I'm just gonna change
the TLOC preference.
The default is zero, so I don't have to do much here.
I'll just give it a preference of 10,
and then I will commit.
So now if I do a show SD-WAN run,
space down all the way to the bottom,
and look at interface gig ethernet one here,
now we see that we have a preference of 10.
So what did that just do to Edge 11 over here,
which is going to receive an update from vSmart
because Edge 13 updates vSmart or controller,
and then it advertises it down to Edge 11.
So let's go ahead and look at Edge 11.
So we'll look at show SD-WAN OMP routes again.
It'll be messy, but we'll highlight
the important information.
And so here's our subnet 10.10.13.0.24.
Notice right away that this looks very different.
I have three paths that are resolved,
meaning I can reach them,
but I didn't choose them and I didn't install them.
Meanwhile, I have one path down here
that was chosen installed and it is resolvable.
So pretty interesting.
So which one was chosen down here?
Well, we got onto gig one,
which is biz internet for Edge 13.
And so if we follow this path, it starts here,
goes all the way over to the right.
So it's through Edge 13,
and then it picks up down here.
And so it's Edge 13 out biz internet.
And so that's exactly what we'd expect.
Now, here's another thing that we might not have expected.
Why did vSmart or SD-WAN controller
advertise all four of these?
Because remember, vSmart's only ever going to advertise
the best path.
If there's four best paths, it'll advertise all four.
If there's only one best path,
it won't advertise the other three.
It will only advertise one.
So why did it advertise all four of these?
Well, we covered this briefly.
And the reason for this is because TLOC preference
is not taken into account by the controller.
It's just a little bit of a caveat.
And the reason for that is because
if the best path is through biz internet,
like we just configured,
and Edge 11 doesn't have an internet connection,
it only has MPLS,
well, then we're hiding MPLS paths
and advertising only a path
that cannot be reached by Edge 11.
So that would be really, really bad.
Instead, what we're going to do
is we're going to advertise all four.
So just drawing this out here real quick.
Let me get my pen working.
There we go.
So Edge 13 is advertising all four paths
to vSmart or the SD-WAN controller up there.
And then the SD-WAN controller's looking at that
and saying that they're still considered equal enough
that we're going to send it down
because the controller doesn't take into account
TLOC preference.
If it did, it would only send the one,
but it is actually sending all four.
Now, Edge 11 is going to run through
the same path selection criteria that the vSmart did,
but in this case,
it's going to take TLOC preference into account,
which is why we actually have only one
that's getting installed.
Pretty interesting, but also pretty cool
how that all comes together.
So what do we expect the routing table to look like?
Well, the routing table,
if we're only installing one path,
should only have one route.
So if I do that show IP route vRF10,
we do see that we only have one path now,
which is through Edge 13.
So we went from four paths to one path on the OMP side,
and we went from two different paths to one path
on the routing table side,
and now we see very clearly why that would be the case.
So what's interesting about this is Site 12,
if we send to that subnet,
SD-WAN knows to split that up
and send it to two different paths.
But now, this route is going to go
to the SD-WAN system interface,
and it's going to look at its OMP table up here
and only see one installed,
and so it's only going to send it out that way.
So sometimes one of these routes might mean
that we're sending it to two different TLOCs,
and sometimes a route might mean
we're only sending it to one.
So we want to really pay attention to the OMP side of things
if we want to look and see what a router is going to do
with a configuration like this.
Now, let's go ahead and revert this.
So if you're following along,
we just want to get back onto Edge 13,
do our config-t,
get onto SD-WAN,
interface gigabit Ethernet with a capital G.
One, there we go.
Get on the tunnel interface.
Now, what's curious about this
is the way to reset the configuration
is actually to say no encapsulation IPsec,
which wipes out our previous command,
and then we can, in the same command section,
just say encapsulation IPsec.
When I commit it, it will commit both of those at once,
and now if I do a show SD-WAN run,
or I could have just looked at that section,
but either way,
we do see that we're back to encapsulation IPsec.
Without the preference command,
and if I come back to Edge 11,
look at the routing table,
both of those routes should be back.
If I were to look at the OMP table,
we would expect to see all four of them.
Yep, right there.
Whoops, just moved on me.
There we go.
All four of them are getting installed.
So that's exactly what we want.
Now, here's the question.
What does this look like from a UI perspective?
How do I go configure a T-Lock preference
using vManage or SD-WAN Manager?
Well, let's change over here to our SD-WAN Manager
and take a look.
So what we're gonna do
is we're going to come to configuration,
go down to our templates,
go to feature templates,
and keep in mind,
anytime we're thinking about
where a particular configuration might be
within the world of SD-WAN Manager,
I can think about the CLI a little bit.
So was that an OMP command we just entered?
If so, then we'd want to go to a template
or go to our templates
and add an OMP template right here.
But it wasn't an OMP command.
It was a tunnel command.
And when we think about
the different feature templates that we've deployed,
which one manages tunnel interfaces?
Well, that would be these right here,
our Cisco VPN Ethernet interface type.
So I can go on to my interface.
Let's say the biz internet interface.
Let's just edit this
and scroll all the way up
because it likes to start me at the bottom.
All right.
So here I can click on tunnel
and this is where pretty much
all of my tunnel configurations are.
So we see that the tunnel interface is enabled.
We see the color here.
But if I scroll up and down,
I do find the allowed services command.
So that's cool.
But I don't see anything in here
for the T-Lock preference.
But I also don't see, interestingly,
anything about encapsulation.
Well, if I scroll all the way
to the bottom of this section,
I'm gonna see advanced options.
If I expand this,
now we see that I've got the ability to enable GRE,
change the encapsulation around.
So here's our whole encapsulation section,
as well as preference and weight,
which we saw were both part
of the encapsulation command.
And so I could change this to,
let's say globally change this
to a T-Lock preference of 10,
something along those lines.
So this is how I would go about doing it
from a VManage or an SD-WAN manager perspective.
But just again,
always think about how it's configured
on one of these platforms.
Maybe again, how it's configured in the CLI
and use that to help me locate it
inside of the user interface.
So that's it.
I hope you found this helpful.
If you did, please give me a thumbs up.
And I'll see you in the next video.
Bye.