So as a test, let's go to VM1 and let's do a ping or a trace or some other
traffic out to the internet at which point as that traffic is going through or
tier zero gateway, it should swap out of the source address from the 10 10 zero
in this case, 10 10 10 10 to one of these IP addresses in the pool.
So here we are at VM1, let's just verify real quick at IP address, we'll do
that with an IFCN FIG, it's also verified surrounding people with a route and
sure enough it's default gateway is 10 10 zero one.
So let's try a ping out to eight, eight, eight to eight, and that's supposed to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's try a ping out to eight, eight, eight to eight, and that's supposed to
work.
So now we enter the troubleshooting phase of our program. So let's do this, let
's see if we can ping from this VM to this VM right here, which is the one at 70
.
And that way we can just alleviate the internet and routing there as one of our
variables. So if we're able to ping from VM1 to this address, because this
address has a default gateway going out to the internet, if the net is working, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
address has a default gateway going out to the internet, if the net is working,
this VM will think
that packet came in from the 23 address space should respond back to it, at
which point this tier zero gateway can untranslate the response and send it
back to our client.
So let's do a quick test by pinging 70 from VM1. So here at VM1 will do a ping
to 23.1.2.70 and that is working. So we've just reduced the fault domain. So
actually before I, we troubleshoot the rest of it, let's go ahead and do a
consistent
error and let's look at our stats for Nat. So back in our NSX manager under WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
error and let's look at our stats for Nat. So back in our NSX manager under
networking and with Nat selected, if we scroll to the right here, here's our
net rule. There's our icon right there for statistics. We'll click there.
And sure enough, we have an active session, 72 packets, if we click on refresh,
because that ping is still happening in the background, that packet count and
the data count should be increasing and they are fantastic.
So another way of a confirmation that Nat is actually working right here at
Gateway zero, let's troubleshoot why this VM can't get out all the way to the
Internet. And to do that, let me go to our edge one, which is the active device WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Internet. And to do that, let me go to our edge one, which is the active device
that's supporting that gateway functionality.
And let's just verify that from the VRF for the services router that we can get
up to the Internet and that will verify our routing from the perspective of the
tier zero gateway itself.
Because if the tier zero gateway can't get out to the Internet, no clients who
are going through that gateway are going to be able to get there as well. So
here we are once again with an SSH connection over to edge one.
And let's do a get gateways. And there's our services router, VRF six, soul WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's do a get gateways. And there's our services router, VRF six, soul
type in VRF six, and we'll get route. And oh yeah.
I swear we looked at this earlier, we had an OSPF learned route, a default
route that pointed to the next top and it is no longer here. So instead of
troubleshooting the external router and saying why it's no longer advertising a
default route.
Here's what I propose we do. Let's just tell our T zero gateway that we want to
have a static default route using the next top of 23.1.2.1.
So we'll do that right now. We'll just tell the tier zero gateway that we want WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll do that right now. We'll just tell the tier zero gateway that we want
a static default route using dot one on the 23.1.2 network as the next top.
So to do that, we'll go to our tier zero gateway right there and we'll edit it
by clicking on the three dots for a tier zero gateway, click on edit, and then
we'll scroll down under routing, open that up, and then for a step.
Oh, static routes. And then for our static route. Oh, I've got an existing
static route and it's got the wrong next top.
So maybe we was just confused because it can no longer reach that IP address.
Hmm. All right. So let's go ahead and fix this. Let's go ahead and click on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Hmm. All right. So let's go ahead and fix this. Let's go ahead and click on
close on there.
And let's just edit our default route. So we'll click on edit and then for the
next top, we'll simply edit that as well. Click on edit and the next top is
going to be for the default route.
And that looks great. Click on add and apply and save and close and close. And
just to confirm that that really took and now has a correct default route.
Let's go back to the CLI. So here at the CLI will hit the upper key for get
route and we should have a static route. Sure enough right there. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
route and we should have a static route. Sure enough right there.
This says the next top for that default static route is 23121 and if and if the
OSPF learned route comes back for some reason, it'll have a better AD of 110
and it should replace the static route with the OSPF learned route.
Should that return? All right. So instead of having to troubleshoot my external
router, we're simply going to use this static default route.
So now that we have a working default route here at the gateway, let's go back
to VM one and see whether or not we can make it all the way out to the Internet
.
All right. So here we are back at VM number one and let's go into a ping out to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
All right. So here we are back at VM number one and let's go into a ping out to
888 and survey says that is working fantastic. We could also do a trace route
out to 888 just to verify we're going through the path we think we are.
We're not going to some loop back address or something else locally in my lab
network. All right. That looks good.
Another cool test would be to go ahead and use SSH from VM one connected this
little VM on VLAN 23 and that way we could also confirm what IP address it
looks like we're coming from when we connect to the dot 70. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
looks like we're coming from when we connect to the dot 70.
So let's go to VM one. Let's open up an SSH session over to dot 70 and then we
can from the perspective of dot 70 see who it looks like we're coming from.
So it should appear even though we're really coming from 10 10 0 10. It should
look like we're coming from some IP address in this range here based on the
source net.
So here is VM one right here. Let me make this a little bit bigger. Fantastic.
We'll just do an I have config for ethernet zero is just to confirm that we're
still on the right device.
We are 10 10 0 10 and let's do an SSH dash L for login as root. And let's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We are 10 10 0 10 and let's do an SSH dash L for login as root. And let's
connect up to 23 dot 1 dot 2 dot 70 and press enter.
So saying do we want this is a very good sign by the way. So we'll say yes, we
want to continue and then we'll supply the password and press enter and that's
not the right password.
So I'll try that again. Fantastic. So now we are connected logically from this
little VM here via SSH up to dot 70. So up here if we did I have config, we're
now logically sitting at dot 70 here showing us that that's the IP address WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
now logically sitting at dot 70 here showing us that that's the IP address
again.
This is SSH from here to here looking at it from this perspective right here
from dot 70. So another way to verify that would be to type in who.
Oh, and that's not showing us the IP address. You know what? Let me pop up a
another VM here up on this 23 network and that will show us exactly who we were
connecting from.
And that way we can verify it from here as well. So give me a moment. I'll pop
in another VM right there with a different flavor of Linux so that can show us
the incoming connections.
In fact, I'll walk you through it so you can see every step along the way. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
In fact, I'll walk you through it so you can see every step along the way. So
let me go ahead to the data center right click and we'll deploy a new OVF
template for my local file system.
Click on upload files. I'll select the DSL OVA again. Click on next and we'll
call this one second VM on 23. And then I'll put this in the same folder VMs
for testing. Click on next.
I'll also put this on a host on my management cluster. Let's put them on ESXIC.
Click on next. I'll put it in the folder called VMs for testing. Click on next.
I'll put it on ESXIC and the management cluster. Click on next. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And again, we'll give credit where credit is due for this really small VM.
Fantastic. We'll click on next. I'll go ahead and choose the local data store
on ESXIC. Click on next.
And then I want to put this on the VLAN 23 port group which will put this VM
connected to network 23.1.2. And there's DHCP services there. We'll click on
next and finish.
Then we'll give that a moment to go ahead and deploy. We'll look at recent
tasks and it is on its way. All right. Super small VM. So it is almost done.
And it is done. So we'll go ahead and power on that VM. Click OK. And then we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it is done. So we'll go ahead and power on that VM. Click OK. And then we
'll open up a remote console to it. So here's that second VM upon my 23 network
that's now initializing.
That's looking good. Let's verify its IP address. So this IP address right here
is 23.1.2.71. And I just want to make sure that SSH services are running. So if
we issued an SSH session from a client down here on the 1010 network and we
connected up to this new server at .71 on this flavor of Linux.
If we do a who it'll show us exactly the source IP address of where that
incoming session is. All right. So here we go. This is the little VM one WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
incoming session is. All right. So here we go. This is the little VM one
machine right here. So I've just opened up an SSH session logging in his route
to 23.1.2.71. And I'll say, yes, I want to continue. It's asking me for the
password, which I will supply.
So now we're logically connected via an SSH session from VM one at 10 10 0 10
up to the second machine. Here on the 23 network at .71. So there's the address
that we connected to right there. And if we do a who now on this system is
showing that we're connected from 23.1.2.155. That's the translated address WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
showing that we're connected from 23.1.2.155. That's the translated address
that we implemented right here at the gateway.
And my attention here is to confirm that the actual network address translation
is really working. So if we typed in exit and we just close that connection to
.71. Then we do a ping, for example, out to the Internet to 888 that should
also work.
And all of that traffic as it goes to our gateway zero is being translated. So
go ahead and stop that ping. Let me minimize these remote consoles. And we can
check that off our list as well regarding source net. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now our next video, what I like to do is do destination net. And that's again
where we're going to swap out on the initial flow of traffic. The destination
IP address and a good use case for that would be if we have users, for example,
out here on the outside of our net device who want to get to a server or some
other device internally that has a private RFC 19 18 address.
So to facilitate that from the outside coming to a private address, we can use
destination net and that's exactly what we get to do in the next video. So I'll
see you there in just a minute.