Recall the goal of direct internet access or DIA. DIA is supposed to allow
our users to use a local internet circuit. So in our case we're looking at
site 13 and I can look at edge 13 here and we've got this Ubuntu host behind it
and edge 13 is connected to what we call the internet in our lab which is this
192.168.255.0 network and so out here we have a .1 address which is the
gateway for the internet again what we're calling the internet so sort of a
fake internet in our environment but the idea here is this I know that I've got
let's say a headquarter site down here and the headquarter site might have
security services and I might want internet traffic to be
tunneled from site 13 down here to the headquarters location so that it has to
go through whatever firewall service we have there maybe we've got URL filtering
all kinds of different security mechanisms that could be in play there
and so that's usually a very good thing but that might not be ideal for the
users at site 13 because instead of just going directly out to the internet
we are going to have to funnel our way through the headquarters location or
whatever our configuration is and by default we don't have a choice because
remember SD-WAN makes it so all traffic has to use these tunneled connections
and so whatever my default route is that's being shared within that
particular VPN that is the path that the Ubuntu host or all of these users at
site 13 they're all going to take that exact same path because we could say
that we're connected to the internet but we're not allowed to like bypass this
internet or this SD-WAN tunnel in order to get out to the internet at least not
without DIA so what we're going to do here is we're going to kind of break
down this architecture and we're going to allow hosts to if we look at this we
still got the tunnel going through the internet but we can allow our hosts to
bypass the tunnel and go straight out to the internet that way this works
great for remote sites where we don't want to have to trombone our traffic
through our headquarters location we can just use local internet circuits it's
gonna be especially useful if this is a site that's way out in the middle of
nowhere or at a different in a different country or a different part of the world
altogether so that is what we want to see happen here specifically within our
lab environment we're going to do this exercise on edge 13 I'm going to get on
to this Ubuntu host which has the IP address of 10.10.13.50 so we're in
VPN 10 at site 13 that's our addressing in the lab environment and I'm just
going to try pinging this subnet specifically this IP address dot one and
we're gonna find that we don't have access let's go ahead and flip over to
that and if I do a ping to 192.168.255.1 we find that it is
unreachable all right so let's go ahead and configure DIA now on site 13 we're
gonna start with the static method remember the static method is a way for
us to do a very quick configuration especially via CLI at a site that we
want to deploy DIA the problem is it doesn't scale very well and so the
scalability is gonna make it so I don't want to do this for large SD WANs with
dozens or hundreds or thousands of edge devices naturally I'd want to use a
centralized data policy for that but otherwise I can go ahead and just
especially in a lab environment or a small network with maybe a handful of
edges I can get in here and configure this fairly simply so the three things
we have to do we have to first of all enable PAT our port address translation
that would be a way for us to share the external IP address on the edge device
we're going to need to perform NATing or symmetric NAT or PAT however we want to
say it on this external edge edges interface here we're also going to have
to do this in a way that meshes with iOS XE's implementation so we're going to
also have to define this interface as an outside interface we're gonna kind
of squeeze that in there outside interface and then step number three
here we're going to need to create a route there's going to be a default
route that is mapped to our global routing table rather than just saying
that we're targeting an IP address we're actually going to shift it because this
device as we've said is in VRF 10 or VPN 10 and so the route must be in VRF
10 but the global routing table is VPN or VRF 0 so let's go ahead and get this
configuration in place so here we are on edge 13 and we're going to perform step
number one which is PAT and probably should have mentioned this but PAT is
going to require us to configure a prefix list if I can squeeze it in there
so we'll see why here in a moment but let's go ahead and just configure that
we'll get into our config T and say IP prefix list and we'll just call this any
and we'll permit permit 0.0.0.0 slash 0 for all addresses the reason why we need
that is because now we're going to configure our PAT and we do that using
the command IP NAT inside source and from here we're going to have to specify
a list now real quick what what are we saying here well Cisco iOS XE uses this
terminology we're configuring IP NAT inside meaning that we're configuring
inside NAT inside to outside so we need to say hey if we're coming from an
inside address that we're going to need to NAT when we go through an outside
address so we'll have to specify that here at step number two source means
that we're changing the source address we want to change our source private
address to a public address out on the internet and so now we need to provide
that list to say what addresses are we matching that would be list any and then
we need to specify the IP address or the interface rather that we are going to
match so it's going to be gigabit Ethernet one I should have specified that
as well by the way that this is gig one interface going out to the Internet and
then we'll specify overload which is iOS XE's way of saying that we're going to
overload the external IP address on the external interface so basically it's how
we configure PAT versus NAT so that is step number one step number two we need
to configure that outside interface this is very simple I simply get on to that
interface gigabit Ethernet one and I say IP NAT outside all right step number
three we need to configure that that route but this route is not just IP
route we're actually going to use a special command IP NAT route and then
we'll specify the VRF of VRF 10 and then this is going to be a default route so
we'll do all zeros and then we'll specify global as the target so this is
saying that we're going to use the global routing table to perform this
match just keeping in mind that the global routing table from an iOS XE
perspective is the VPN zero routing table from a VIP teleperspective so this
is using the iOS XE term because we're performing iOS XE command so it's a
global routing table so at this point I'm going to commit all of these changes
and we should be able to come back to our host here and well just run the same
command ping 192.168.255.1 earlier it wasn't working now it is indeed
working so that is how we perform you know let's just go ahead and end the
pings but that is how we perform DIA from a static configuration perspective
again I can't get onto every single edge in large environments and do this and so
now we need to explore how we would do this using SD-WAN manager and we'll test
it from one of the sites that are being managed by SD-WAN manager