Alright, let's dive a little deeper into the VPN conversation.
We know that our controllers can use VPN zero and VPN 512 and that is it.
Now, a quick note about this.
First of all, we're talking about a controller and a manager.
They are only going to be able to use zero and 512.
Those are the only VPNs available.
The validator is a little bit more interesting because remember, the validator
is actually
built on a V edge type of software.
Yeah, we're talking about the original Viptel software at this point and a V
edge, like
any other Cisco edge device, is capable of configuring a wide range of VPN IDs.
So zero to 512 and then 513 and up.
And so at this point, we recognize that we could actually get on the
configuration of
a validator.
So it's not a V edge anymore.
It's a validator or a V bond.
And this validator running the same software as an edge device is capable of
those configurations.
However, when it's running in validator mode, this is no longer going to apply.
And so we're going to still need to configure zero and 512 only.
So I wanted to point that out because the software limits this to 0 and 512 for
the controller
and manager, but we might find that the validator doesn't necessarily restrict
it from a software
perspective.
But if we want to configure it as a controller, then we are still going to have
to abide by
zero and 512.
Now the other thing to keep in mind is that whenever we configure a device,
just like
with VRF, since Cisco devices, every interface that we configure, whether it's
going to the
LAN or it's going internally to a LAN side, so this would be where our users
are, either
way, we're going to have to configure these interfaces to be in a VPN.
Usually when we're talking about the underlay of the network here, this is
going to be VPN
zero.
And this is a requirement.
We don't get to change that.
I say usually because usually the underlay directly connects in here.
There might be some situations where it doesn't, but we do understand that we
're forming our
connections to the LAN on VPN zero.
The internal VPNs, it could be something internal like VPN 10.
And then if we do have an outer band management interface, that's where VPN 12
comes into
play.
So this is like the concept or illustrating the concept of VPNs using edge
devices, which
have physical interfaces.
Well, our controllers are going to be no different.
So now we've got to think about these controllers as actual networking devices.
So remember, these are going to be virtual machines.
So we've got our manager, our controller and our validator.
The control devices are going to have two networking interfaces on them.
So we're going to have the opportunity, as we drew out before, to connect these
into a
VPN 512 management network.
Now a lot of organizations will just use that as a separate VLAN.
So if we've got a layer three switch over here, we might have some kind of
interface
here in a VLAN, we would call it VLAN 512.
And then we can get to the management domain there.
Meanwhile, we might have another SVI on this side.
And we'll just call this 100 VLAN 100 because the VLAN IDs don't have to match.
Keep that in mind.
But this is going to be where VPN zero lives from the controller's perspectives
.
So they're going to connect in here.
So I as the admin, I might be able to use the layer three network to connect
either one
of these.
But keep a couple of things in mind.
Remember 512 is for management only.
Meanwhile, when we're talking about forming tunnel connections and having
communications
back and forth among the controllers, it's all going to happen across VPN zero.
So this is where our TLS or DTL connections are going to be.
And the way we're going to be sending information.
But this is also where we connect out, as we've said, to the edge devices.
So the edge devices are somewhere out in the network.
And so they're going to use VPN zero in order to get out.
But think about what we just said up here about the fact that VPN zero is the
underlay.
This is where things get a little bit interesting because now I'm going to have
a data center
location and this data center location is going to be part of my SD WAN
environment
in all likelihood.
And I'm going to have the controller and I'm going to have the validator and
the manager.
And they're all going to be part of this network that lives on one side of the
SD WAN device.
And meanwhile, I'm going to have another VPN zero connection going this way.
So if the internal connections are going to be part of a different VPN, let's
say VPN
10 again, then how do I make this happen?
How do I bridge the gap between the two?
Well, we've got a couple of options.
First of all, we could extend VPN zero on a dedicated VLAN.
That's not out of the question.
We could certainly do that and extend it that way.
However, we could also perform netting.
And so if I can perform net, then at that point, I can translate between a
public IP
address and a private IP address.
As a result now, if we're performing net on these devices, then when we're
connecting
into VPN zero, this keep in mind, we might have a MPLS network here and the
internet
until we got connections into both.
But now when an edge device needs to communicate, first of all, to the valid
ator to get online.
Okay, no problem.
We connect through the internet, but then the validator tells us where my
control, my
controller and my manager are.
And it's going to provide that public IP address.
So then I can simply go through the NAT process in order to get to my
controller and to my
manager.
So that's certainly one option.
The other thing we could do is route leaking and route advertisement and make
sure that
even though I've got a private IP address going this way, that if I'm given
private
IP addresses by the validator, then I could go this way.
I would just have to make sure that the networking facilitates that.
So we just need to think about the networking that's associated with our
control devices
and make sure that our edge devices are going to be able to reach out.
Usually that involves public IP addresses for all of them, but at a minimum, we
need
a public IP address on the validator, as we've said repeatedly, and we could
facilitate
private IP address communication in order to connect to the controller and
manager,
form those tunnels and then allow me to start creating IP sec tunnels to remote
edge devices.