So now that we've had a few moments to consider
some of these questions, let's compare notes.
So first of all, if we want to allow clients here
on the 1010-0 network and the 1020-0 network
to go out to the internet, we need to swap out
those source addresses first with a routable address
on the internet before we can let those packets fly
because if we don't translate them,
they're not gonna make it all the way through the internet.
So as far as which type of net should be used,
it should be source net or S-net for short.
And then the next question is,
which gateway would you apply the net rules to? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which gateway would you apply the net rules to?
And so we could do it here and here.
Now currently in our topology,
these are just distributed routers.
So if we wanted to implement net services here,
that would also invoke injecting a services router here
on gateway A and on gateway B.
Also we'd have to have a rule here for these VMs
and a rule here for these VMs.
So to make it simpler and also because we already have
a services router function here at the gateway zero,
it's very likely we'd want to implement
our net services right here.
And so currently we have an active standby situation WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so currently we have an active standby situation
for tier zero with edge one and edge two
providing that support.
So we could go ahead and just simply add a net rule here
that says if traffic is source from 10.10.anything
or coming from 10.20.anything,
go ahead and do that translation.
And as far as what we translated into,
that leads us to the next question.
And that is, will you use one-to-one
or many-to-one address translation?
So if we have four or 500 clients or devices
that need access to the external network,
it's very unlikely that we're gonna have four WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it's very unlikely that we're gonna have four
or 500 uniquely routable addresses
that we've been given from our service provider
or more correctly we've purchased from our service provider.
So oftentimes we'll do a lot of overloading
on a single-address leveraging port address translation
with a many-to-one scenario.
So let's say for example, we want to take
anybody who's coming from these source addresses
and we will map them to 23.1.2.
Let's go ahead and use 99.
So that's a nine-feet address that's spreadable
on the internet and let's also imagine
from a service provider perspective,
they have assigned us that IP address that we can use. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
they have assigned us that IP address that we can use.
Another option would be to overload on an existing address
that would be another option as well.
So far plan is to use a single IP address,
then we'd be implementing effectively PAT
with many-to-one address translation
with many VMs down here as they go out to the internet
being mapped to a single IP address.
And since we have the topology already in place,
let's go ahead and walk through the implementation
of source NAT,
implement it here with a net rule here on the tier zero gateway
using a many-to-one mapping. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
using a many-to-one mapping.
Mapping all the clients on 10, 10, 20
will map them all to the single IP address right here
before forwarding it out to our external router.
So with that in mind, let's configure NAT.
So here in the NSX manager, we go to the networking tab
and the left side down under network services,
we click on NAT.
So currently from our demos earlier,
we have a source NAT rule and a destination NAT rule,
and I am going to delete both of those
and we'll replace it with the one based on the validation
challenge we just took a look at. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
challenge we just took a look at.
And click on refresh, we now have absolutely zero NAT rules.
So to start off, for the NAT rules,
we want to apply the NAT rules to our tier zero gateway zero.
So we'll select that tier zero gateway
and then click here on add NAT rule.
So we'll call this S NAT dash fee for validation.
That's the section we're in.
And the type of NAT we want to do is source NAT,
swapping out the source address on that initial flow of traffic.
And then here for the source address,
we want it to be in the 10.
In fact, we can do this.
We say 10 anything with an 8-bit mask.
And that way any source IP addresses WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that way any source IP addresses
that start with 10, 10, 10, 20, or 10, 30, et cetera,
as long as they start with the first octet of 10,
they're going to match this rule.
And then for the destination, we'll leave that empty.
So they could be going to a Google DNS server
or any resource out on the internet.
It'd be great.
We're not going to constrain that for the NAT rule.
And then for the translated address,
what we want to use based on our plan is 23.1.2.99.
And then if we wanted to lock this down
to specific edge ports, we can go ahead and click on set
and simply select them right here.
Or we could not select those and leave that empty. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Or we could not select those and leave that empty.
It's not required to put it in.
So they would still apply to our active edge nodes
and we're not constraining it with this set option right here.
So we'll scroll down, click on save,
and let's check our work.
And this source NAT rule says if traffic is sourced
from 10 anything, including devices on the 1010 or 1020,
et cetera, as they go through this gateway, Gateway Zero,
based on the Gateway Zero's routing,
it's going to go ahead and swap out the source address
from the 10, whatever address it was,
to the new source address of 23.1.2.99.
And that'll be true for a bunch of VMs WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that'll be true for a bunch of VMs
that are going through this gateway.
So that's the example of doing many to one with source NAT.
And over here, it understands it says,
uninitialized, we'll click on the refresh,
and that looks good.
And if we click here, that's going to show us these statistics.
So currently there's no traffic
trying to go through the gateway
and there's no translations as a result.
So we'll click on close, we'll collapse that,
and let me expand the left-hand column, fantastic.
So let's go ahead and test this out.
So for testing, let's go ahead and open up VM1
and also VM2.
It'll give us an example of two different subnets. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It'll give us an example of two different subnets.
And let's go ahead and try to send traffic out
to the internet.
And if that's successful,
all the way out to the public internet,
that implies that we have a address translation
that's currently functioning here
at our tier zero gateway based on the rule
that we just created.
So let's go to VM1 and VM2 and let's test it out.
So here is VM1, I'll bring that over here on the left.
And let's do a quick IAF config for ethernet zero,
just verify it's IP address.
So that's here at 10100.10, fantastic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that's here at 10100.10, fantastic.
Let's also bring in VM2, which should be at 10200.20.
So here is VM20 right here.
I'll put it over here so we can still see the topology.
And a confirm its IP address,
we'll do an IAF config or ethernet zero.
And sure enough, it has the IP address as expected right here,
10200.20.
So this is VM2.
And over here, this is VM1.
And as a test, let's send traffic out
to a Google DNS server at 8.8.8.8.
So let's start over on VM1 with a ping to 8.8.8 to 8. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's start over on VM1 with a ping to 8.8.8 to 8.
And that looks like it's working.
Great, great, great.
We'll do the same thing over here for VM2,
we'll do a ping to 8.8.8 to 8.
And well, those are both running.
Let's go to our tier zero gateway
and just verify that we have our stats
that are being incremented regarding our NAT rule
that we created a moment ago.
So here in the NSX manager,
I'll go ahead and collapse the left-hand side.
So in our networking and NAT,
we'll click right here on the icon for stats.
And sure enough, we have packets that are going through. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And sure enough, we have packets that are going through.
And because those pings are still going,
if you click on refresh,
the packet count and the data count
should increase every time we do a refresh.
And that looks great.
The other interesting thing I'd like to show you
is based on the NAT rule that we have set up,
our services router and its routing table
is gonna be slightly different
because it now has to accommodate
for that address 23.1.2.99,
which is using as part of network address translation.
So if we click on close here
and let's go to the CLI for edge one,
which is currently, let's verify that real quick.
It's currently the active node, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's currently the active node,
it's doing actually the data plane work
on behalf of the tier zero gateway.
So here we're connecting to the management IP address
on edge one, and then we'll do get gateways.
And then specifically,
I wanna take a look and go inside the VRF
for this services router right here,
which is VRF number six,
so we'll type in VRF six.
And here we can do things like get route
to look at the routing table
and where those routes came from.
We can also do a get forwarding,
which is another way of looking at routing information. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which is another way of looking at routing information.
And then here in VRF number six
for our services router,
if we should get interfaces,
I'll use a pipe symbol and I'll go ahead and type in more.
That way we can do one page at a time
and I'll press enter a few times,
go down a little bit further,
check out this interface right here.
It's a loopback interface that it created
for the purposes of network address translation.
So 127.001 is the default IPV4 loopback address.
And in addition to that,
it has this IP address also set up as a loopback,
23.1, 29.99.
So it's leveraging this loopback address
as part of the network address translation that we've set up. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
as part of the network address translation that we've set up.
And another cool thing is that if we went back
to this NAT rule that we had and we edited it
and we said, you know what,
instead of just being the 23.1.2.99,
let's go ahead and modify that.
And let's make it 23.1.2.99 through 23.1.2.
Let's say 150.
So now it's gonna be a whole range of IP addresses
that can use as part of the source NAT
and we'll go ahead and scroll down, click on save.
So now that we've updated that and give it a bigger range,
check out what it did behind the scenes WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
check out what it did behind the scenes
regarding its loopbacks.
So a moment ago, we had this one loopback with this IP address.
Now if we do the get interfaces for this router
and let's scroll up a little bit,
check out our loopback interface.
It now has not only just one IP address,
but it has all the IP addresses
that we specified in that range.
So if we scroll to the right a little bit,
it just goes on and on and on
because it has all those IP addresses
that it's responsible for
as part of the network address translation process.
And if we scroll up a little bit,
it also is showing us regarding proxy ARP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it also is showing us regarding proxy ARP.
So effectively, if someone does an ARP request
for any of these IP addresses
because we're using those or could be using those
as part of our network address translation,
that trains this gateway to respond back
when somebody's looking for the layer two address
associated with these layer three addresses.
And again, these are all the layer three addresses
that we're using or can use
as part of our network address translation.
So I thought it'd be useful in seeing behind the scenes
what it's doing to support that range of addresses,
including associating all those with its loopback
and then also being prepared to respond to ARP requests WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then also being prepared to respond to ARP requests
for any of those IP addresses
that it's using or could be using
for network address translation.
Also here in our VRF for the services router,
if we did a get route, check this out.
Not only did they have its normal routes,
which include our static default route here
and the routes we're getting from our tier one gateways,
but we also have these routes little N here.
And the decode for that is right here.
That's a tier zero NAT on this tier zero router.
And we press enter a few times,
those are gonna continue for the entire range of addresses WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
those are gonna continue for the entire range of addresses
that we're using for network address translation.
Or if we did a get forwarding and press enter,
it also is gonna have all of those routes
identified right here as well.
Because this gateway is now responsible
for responding to and acting on behalf of those IP addresses
in the event they're used
as part of our network address translation.
So regarding this validation section,
we've not only discussed some of our options here
regarding NAT for customer traffic,
but we've also implemented it
and verified that it's working.
So thanks for joining me.
In this set of videos and in the skill,
we're getting network address translation with NSX. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we're getting network address translation with NSX.
And I'll see you my friend in another skill very, very soon.
Until then, I hope this has been informative
and I'd like to thank you for viewing.