All right, so now what we want to do is configure a VPN membership and topology policies.
But keep in mind that with the way we did it with manager, we created a centralized policy.
We kind of included these policies within it.
We had the VPN membership and the topology policies, and so they kind of got applied at the same time.
And that's how manager manages things.
Remember, manager is just keeping all of this configuration, and it really only pushes things down that it requires.
So if we have 100 VPN lists for 100 different VPNs, and we only really need to push out a few of them,
then we'll only push those VPN lists out that we need.
And so what it's doing on the back end is not necessarily how it represents it with the UI.
So that's why it's always so important for us to understand what's actually happening behind the scenes.
And certainly another value to learning CLI is seeing what exactly is happening behind the scenes.
So what's going to happen now, this is the graphical user interface version up here.
What we're now going to do is see that we're going to configure, first of all, there's no such thing as a topology at the CLI.
Instead, we have to think about what we did to create a topology policy.
Instead, what we did do is we created a control policy, and that control policy had route and TLOC match action statements.
I controlled where the routes went. I controlled where the TLOCs went.
The hub and spoke was more of a template that Cisco provided. That was great. It did it for us.
And then remember, we did the custom topology where we controlled the routes and the TLOCs separately.
So when we break it down, we're going to find that the CLI is doing exactly that.
It's giving us the ability to create a control policy that includes route and TLOC match action statements.
So, so much of it feels like we're just configuring route maps.
And then over here, we're going to still create a VPN membership policy.
They're not part of this wrapper that we had with the graphical user interface.
And instead, we're going to apply each of these individually to site lists.
And because this is the controller, it's going to use that information to basically decide which sites are getting this information
or when I advertise toward a site, how I'm going to do this.
And remember, we apply at least the control policy in a direction, inbound or outbound.
I need to control the flow of routing and TLOC information, whereas VPN memberships,
this is basically saying which sites get which VPNs or maybe which sites are rejected from getting certain VPNs.
So let's go ahead and look at the configuration. We're still on the controller here in config mode.
We're going to start by creating a control policy.
In theory, we have all the lists necessary to make this happen.
So we're just going to do a control policy here.
So control policy. And then we'll name this something like control policy CLI.
And now we immediately go into the sequence and match action statement.
So again, we have to think about how this breaks down.
I'm going to create a sequence number.
If I can spell it, there we go. Sequence 10, let's say.
I like to go in tens in case we need to inject one later. We can inject a five or a six or something.
But we start with sequence 10 and we go into match action statement.
So when I do a match, I have to define whether I'm matching route or TLOC.
Exactly what we set up here. We're going to create policy around routing and TLOC information.
Routes are just as they implied. It controls the routing information, those OMP routes,
whereas TLOC is influencing the proliferation, fancy word, but the spreading of TLOC information.
And that ultimately creates tunnel control. So I'm going to start by saying match route.
We'll do a question mark here and we'll see all of the things that we can match on.
Remember, I just said we're going to match. And this is the type of thing that we're controlling.
We're controlling our routes. But what are we matching on?
So I can match on a color list. I can match on a site list.
I can individually match on site IDs and colors and things like that as well.
And the UI provides that opportunity for us, too.
So I can, let's say, match on a prefix list. I could say we're going to match on prefix list, match any.
Let's see here. Oh, yeah, site list. So we can match on a site list.
And so we can do a question mark. It gives us some of the site lists that are created here, which is nice.
We'll just match on site 11, let's say. Actually, let's match on site 14.
Just targeting sites that don't actually exist in the lab environment.
Although we're not committing this, so maybe it doesn't matter.
But either way, we're just matching on that site list and we're going to match on a VPN list as well.
We'll use that VPN customer A VPN list we created.
So, OK, well, that was a lot. We just created a match statement, but that's only half of it.
We have to create match action statements. So what is the action?
What are we doing to this information? So I've got options here. I can accept or reject.
The default action is to reject. But let's say that I want matching any prefix out of this VPN at site 12.
I want to accept that information from a routing perspective. So I would say action accept.
OK, so once again, it keeps shrinking our context, but really we are still within our sequence 10.
So I have to think about the breakdown here. Let me just kind of sketch this out real quick.
So the breakdown is that we have a sequence number like sequence 10 and then we're within it.
We're going to have a match statement and we have to specify whether this is route or TLOC.
And then I do my matching and then I say action. All right.
And so what is my action? Is that to accept or reject? In this case, we said accept.
Now, from here, I can include additional sequences, so I could say like, let's say, sequence 20.
And then I could do a match on a TLOC route or something like that.
But eventually, I know I'm out of space down here. Eventually, I'm going to have to get a default action in here as well.
So those are some of the configuration things that we're trying to put together here just to give a give a visual.
All right. So we did sequence 10. Let's go ahead and do sequence 20.
So I'm going to say sequence. Let's exit out first of all of sequence 10.
And now we'll create sequence 20. And so now we can match on a TLOC route.
And I could, again, what am I matching on? Maybe I want to reject the TLOCs while allowing the routes from, what do you say, site 14.
So maybe I could say something like site list. And again, that would be site 14 here.
And then I exit out and then I set an action and I say we're going to reject that information.
And we'll exit back out. All right. So now we're on sequence 20 again. Let's back out of sequence 20.
And now we can set a default action for this entire control policy. And the default is to reject.
But maybe I could say, hey, we're accepting some things, we're rejecting some things, but we want to accept everything else.
Or we could reject it. But, you know, this is not a good policy.
What we're doing here is not necessarily going to accomplish much.
But it is something we just we need to learn the syntax and how to actually configure it at this point.
All right. So that is it for creating our control policy.
So we've backed out of the control policy. We're now just in the broad global policy configuration.
We can configure a VPN membership policy. This is a little more straightforward.
I'll just say VPN membership and then I can create whatever name I want.
VPN mem CLI. And we do still use sequences. So I'm going to say sequence 10 and then match.
But I'm not matching on. I don't have to decide whether I'm matching on this or that.
You could. But again, we can combine our configurations. Let me demonstrate.
So I could say match, enter. And so what are we matching on?
Well, we're matching on VPN list of, let's say, VPN.
Customer A. All right. And so then I can define the action.
Whoops. Again, exit out and then define the action for sequence 10. All right.
Let's try this again. Action. And then it wants us to do it all in one line.
OK, fine. So we'll just do accept. All right. Exit out of that. Exit out of that.
So now what if I do sequence 20 and now I could do the same thing rather than saying match, enter.
I could just say match the VPN list, maybe VPN list, VPN 10.
And then I can exit out and say action reject like that.
So lots of different ways to configure this, just kind of keep track of how it ends up working out there.
But now we have to apply it. So interestingly, to apply a policy, we get out of policy mode.
This is for configuration, not for application. So I'm now at config T again.
I'm going to enter into the apply policy configuration set and I've got to decide where I'm applying policy.
So I'm going to specify the site list first, interestingly. So I'm going to say site 14.
And now that I'm inside of applying a policy to this particular site, I can decide what policies to push.
So I can send my control policy here. I can tab over, fortunately, with that long name.
And again, with control policies, because it controls the flow of control point information from the controller's perspective,
I have to define whether this is in or out. So usually we go out here.
And then I can also apply a VPN membership policy, which we said VPN mem CLI there.
So there's no in or out for VPN membership. I just hit enter here.
And that is how we go about applying our policy that we've created.
So, again, just a quick takeaway from this video. We configured a control policy that had route and TLOC statements.
We also saw that the structure within each of these is a little route mappy because, again,
we have the sequence statements with match action within them.
We have to decide what we're matching. And in the case of control policies, whether we're matching routes or TLOCs.
And from there, we can decide whether to accept or reject that.
And we do want to make sure we have default action defined as well for those different policies.