In this video, we're going to configure and verify destination net in our top
ology.
And to do that, we're going to leverage this server right here at .13 on the 10
10 Zero Network.
And let's go ahead and map that to this globally-routable address, or at least
in my lab environment,
this globally-routable address. So that way, when an entity or user somewhere
here on the outside of
our gateway attempts to reach the 2312254 address, so I'll put that right here,
23.1.2.2.54,
we're going to map that over to the internal address of 10.10.0. And based on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we're going to map that over to the internal address of 10.10.0. And based on
the IP address
we have on that server right now, it's a .13. So on the initial flow of traffic
, we're swapping
out the destination address from this to this. And that's why it's called
destination net. And
then for the reply traffic from the server back to the client, this net device,
our tier zero gateway,
who did the initial destination net translation, will untranslate that packet
and then put the
original information back in. We're going to the IP addresses and forward it
back out to the client.
So as part of our process here, let's just take a moment and verify that our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So as part of our process here, let's just take a moment and verify that our
server right here
really is at 1010.0.13. And assuming it still is, we'll then proceed to put in
our destination
now. So this is my little server on segment 10 that we placed earlier. And it's
IP address indeed
is 1010.0.13. Also, what I'd like to do is modify the default webpage for this
server. And that way,
when we connect to this server, we can verify we're connected to actually this
device right here.
And just to verify that, I'm going to go ahead and connect on this local server
to its own webpage. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to its own webpage.
So they've got a bare bones browser right here. So we'll go ahead and launch
that. And we'll go
to 10.10.0.13 press enter. And sure enough, right there, this is our server at
.13. So when we
connect from a device that's external or outside of our gateway, and we connect
to the globally mapped
address, and it shows up at the server, that way we can confirm we're actually
being mapped to the
right server. All right, let me move that out of the way for a moment. And now
that we have that
server all set up here at .13, let's set up the destination at and map that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
server all set up here at .13, let's set up the destination at and map that
internal address of
.13, so that when initially it's connected to on this external IP address, 2312
24, the NAT device
does destination at and redirects it down to the server right here. So to set
up that additional
destination NAT rule to do that, we go to networking right here in the NSX
manager.
And on the left, we'll go down to net under network services. So there's our
source NAT,
and we'll click on add to add a new rule. And this one, we're going to go ahead
and make a
destination NAT rule. So we'll call it for server. And then for the type of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
destination NAT rule. So we'll call it for server. And then for the type of
rule, it's going to be
a destination NAT. And then for the source IP address, if we don't care where
it's coming from,
the initial source address, we can leave that blank. And then for the
destination address,
this is where we have specified the destination address of where they're trying
to go to.
So in our case, if they're going to 23.1.2.254, that actual IP address, then we
want to swap out
with destination NAT, that destination address, we want to use the address of
10.10.0.13, which is
the address of our server on the yellow segment. Then we click here on set and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the address of our server on the yellow segment. Then we click here on set and
make sure it's applied
for both of our interfaces, click on apply and click on save. And then it says
here uninitialized,
we'll go ahead and refresh that. That looks good. So here, if we click on the
icon for the stats,
that's right there, it's showing us no active sessions at the moment, no packet
counts and no
data. And that's because we have not yet matched on any traffic for this
destination NAT rule.
So we'll click on close there. And let's test this out. And this server,
besides just running
the web services that we configured, it also supports SSH. So we could go to a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the web services that we configured, it also supports SSH. So we could go to a
device out here.
In fact, we could go to .71, which has the little teeny web client that we just
placed
out there on that 23 network. And then from that device on 23 network, we could
test out web
connectivity, going to the global address here 231224 and verify it redirects
us here to the server.
We could also initiate an SSH session, which could also verify we're going to
the right server as well.
So let's do both. So to test this on the right hand side, I've got a client
machine, and this is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
machine, and this is
on the 2312 network. It's a .71. And this can be our client. And then over here
on the right,
we have our actual server at 10 10 0 13 and it's running SSH services. So we
should be able to
issue or start an SSH session from here going to the globally mapped address,
which is 23.1.2.254.
And then gateway zero with this destination NAT should swap that over the
destination address
to the address of 10.10.0.13. And then forward it down to that IP address. And WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to the address of 10.10.0.13. And then forward it down to that IP address. And
one of the easiest
ways of verifying all that would be to simply do SH from here from the client
to that IP address
and verify we end up over here at the server. So over here on the right, let's
go ahead and do an
SSH space dash L and we'll log in as root. And we'll direct our SSH session
towards the IP address
23.1.2.254 and press enter. So it's asking us if we want to continue connecting
. So that's a very
good sign that is working. We'll type in yes. And it's asking me for the
password on the server. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
password on the server. So
we'll go ahead and put the password in for root. We are connected to this IP
address 23.1.2.254.
But due to destination NAT, the gateway mapped that over to 10 10 0 13. So our
SSH session is
really connected to the destination address of 10 10 0 13. So we can verify
that here through
our SSH session by typing in if config for ethernet zero. And this is showing
us the IP address because
in the context of this SSH session, it's as if we're sitting at the server over WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in the context of this SSH session, it's as if we're sitting at the server over
on the left.
Also at the server on the left, if we did a who to see who's connected to us.
So here shows
we have two connections and they are both for me. So I did one a while back
just to verify I could
get connectivity. And then I turned on the camera and recorded this one. So
this address right here
23.1.2.71 is the source address on the client on the right hand side that we're
connecting from.
So using SSH is just a convenient way to not only confirm that NAT is working,
but also to verify
the IP addresses that are involved for that translation. Also back here in the
NSX manager,
if we go to networking and then on the left, we get it on to NAT. Here's our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if we go to networking and then on the left, we get it on to NAT. Here's our
NAT rules. I'll
collapse that on the left gives a little more room. So for this destination net
rule for the server
over here. Now if we click on statistics, little like on there, it's now
showing us how many active
sessions we have, the packet counts involved and how much data has gone over
that translation.
So these are the stats for the destination net rule and for the source net that
we did earlier,
if we click there on the statistics, here's the counts for there as well. So
based on our game plan,
I think we are done with the core content for this skill. We updated our top WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I think we are done with the core content for this skill. We updated our top
ology,
use the 23 network and the VLAN 23. We deployed a couple new VMs for testing.
We set up source net
for outbound traffic. We set up destination for the benefit of incoming traffic
and being able to
reach a specific server on the inside. And also to help validate and reinforce
what we've learned
in this set of videos. In the next video, I'd like to pose a little challenge
regarding NAT.
So when you're ready, I'll see you in that next video as we validate our
knowledge together.