Alright, so our first step in our game plan is to verify and update our top
ology.
So let's take a moment right now and do that.
So here in the vSphere client, let me go ahead and take Mint 1 and I'm going to
rename
that Mint 10 and make sure it's on the 10 segment right there.
So I'll right click on Mint 1.
From the menu, we'll go ahead and click here on Rename and then we'll go ahead
and call
it Mint 10 and click on OK.
And then we'll take Mint 2 and we'll make it Mint 20 again based on our plan
right there.
So we'll right click on Mint 2 from the menu, click here on Rename and we'll WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll right click on Mint 2 from the menu, click here on Rename and we'll
call that
Mint 20.
Then we're also going to need Mint 23 up here.
So let me go ahead and first of all, make sure that Mint 10 and 20 are on the
right segments
and then I'll clone one of them and put them up here on the 23 network.
So let's go to the networks tab here for a moment and there's segment 10 yellow
, there's
Mint 10 that looks good.
Let's go to segment 20 pink, there's Mint 20, perfect.
So now that we know they're on the right segments, let's take Mint 20, we'll
right click on it
and from the menu, we'll click on clone and then from the clone sub menu, we'll
click
right here and clone to virtual machine and let's call this Mint 23. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
right here and clone to virtual machine and let's call this Mint 23.
As far as where we want to keep that, let's put in a folder called VMs for
testing, we'll
click on Next.
Let's go ahead and put some ESXIA and click on Next and then we'll put on the
local data
store, we'll use thin provisioning, click on Next and then we'll customize it
to put
it on the right subnet here, the 23 network and then we'll have it power on
automatically
after it's done, click on Next and then here instead of being on the pink sub
net, we'll
click on Browse and we want to put it on the 23 network.
So I have a port group for that, here it is. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I have a port group for that, here it is.
It's not an ESX port group, it's our external network here, it's VLAN-23.
So we'll select that, click on OK and then click on Next and then click on
Finish and
in a few minutes, we should have a brand new VM right here called Mint 23
connected to
the 2312 network.
So also let me check on it's tab show quick, okay, so it's being deployed.
Let me also go ahead and power on Mint 10 right here, so let's simply power it
up.
So that's this VM right here and let's also deploy my little web server right
here and
we'll call it Web 10.
So we'll right click on the data center from the drop-down, say I want to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll right click on the data center from the drop-down, say I want to
deploy an OVF
template, I have those files locally, so I'll click right here and upload files
.
So I've grabbed that file, I'll click on Next.
So we'll go ahead and name it Web 10 and then we'll go ahead and place that in
the VMs
for testing folder, click on Next and then let's host this on ES6IB and click
on Next.
We'll put it on the local data store there, I'll use thin provisioning, click
on Next
and then put it on the right port group.
So I want this one, this Web 10 VM to be on segment 10.
So we'll click on Browse and we'll put it on segment 10, click on OK, click on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll click on Browse and we'll put it on segment 10, click on OK, click on
Next
and then click on Finish.
Then we'll check on our status, I'll click here and please show me all running
tasks.
So it's still deploying Mint 20, it's about halfway done there and it's down
the process
of deploying our little web server right here, Web 10 and that's a teeny little
VM so that
shouldn't take too long.
All right, so that's making progress, great, great, great.
So while that's being deployed, let's also go ahead and update our NAT policy.
So based on our plan, we wanted to change the source NAT and make sure we're
just doing WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
just doing
NATting over to one single IP address here instead of a pool of addresses and
what we
want to do NAT to is 23.1.2.60 on our Tier Zero Gateway.
So let's do that next.
So we'll go to the NSX Manager, we'll click here on Networking on the left
under Network
Services, we'll click on NAT.
Currently right here under NAT, we have this Net Rule associated with our Tier
Zero
Gateway that's doing source NAT and there's the range of addresses.
So I'm going to click on the three dots, click on Edit to edit that NAT Rule
and let's
say we want to go ahead and not use this range of addresses and let me go ahead WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
say we want to go ahead and not use this range of addresses and let me go ahead
and
collapse the left hand column and give us a little more room here and instead
of using
this pool of addresses, I'll click on the X to remove that.
What we want to do is map it to 23.1.2.60 which is the virtual IP address we
assign to
Gateway Zero and with that in place, we'll scroll down and click on Save and
now that's
done, let me go ahead and bring in a client.
So let's go over to Mint 10, we'll verify first we can get out to the internet
and also
let's also verify by just doing an SSH session over to our little external
router here that
it appears that we're coming in from 23.1.2.60 and that'll help guarantee that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it appears that we're coming in from 23.1.2.60 and that'll help guarantee that
we're actually
using the NAT as intended.
So back here on the VSphere client, let's go to Mint 10 and let's launch a
remote console
and here that is, fantastic.
Let's also verify its IP address.
So we can have an IF config or IP address.
Either way is great, they're both going to show us the IP address in use and
this is
10100165.
Let's verify we can get out to the internet with a trace, we'll do a dash N for
don't
bother doing name resolution and let's go out to Google at 8.8.8.8 press enter
and that's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and that's
looking good, I'll do a control C to stop that.
I just want to make sure we're getting out to the real internet.
Let's also do an SSH dash L login as a user of VYOS to this little gateway
right here
at .1.
So that's the 23.1.2.1 press enter, I'll put in the password and we'll type in
who and
that should confirm whether or not the NAT is working as intended.
So from this little router's perspective, it looks like it's getting an inbound
SSH
connection coming from 23.1.2.60, which verifies our NAT. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
connection coming from 23.1.2.60, which verifies our NAT.
Now also in preparation for setting up our gateway rules, I want to have a
destination
NAT rule for this little Web 10 server as well.
So let's bring that console up next.
So we'll go back to the vSphere client and here is Web 10.
Oh, I thought I told it to turn on.
I guess I didn't.
So we'll select Web 10.
Let's just verify it's on the right segment.
So it's on seg 10 fantastic and let's power it on.
Now this little VM does not have VMware tools.
So I'll have to be careful about how I power it off and do it gracefully.
But for our purposes, it's a super small VM and it has web services running as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But for our purposes, it's a super small VM and it has web services running as
a default.
So let's open up a remote console toward little Web 10 server as well.
Just to verify its IP address.
So we'll click here on launch remote console and then let's bring in that
little Web server.
And here it is right here.
So I'm showing you right here.
It's IP address is 1010.181.
We could also verify that by opening up a shell.
So here if we do an IF config and let me zoom in a little bit there.
So sure enough, it's IP address is 10.10.0.181.
So I'm going to make a note of that that that is the IP address for this little
Web
server right here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
server right here.
So if we want to set up a destination NAT here on our gateway zero that leads
to this
little Web VM.
So we can go ahead and map the global address of 23.1.2.181 and have that map
down to this
Web server at 1010.181.
So to do that, we'll go to the NSX manager.
So here in the NSX manager with the networking tab selected on the left, we've
selected NAT.
Let me go ahead and collapse that left hand side.
And let's add a new NAT rule.
So we'll click right here, add NAT rule.
Also if you want a further deep dive into the world of sitting up and working WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Also if you want a further deep dive into the world of sitting up and working
with NAT,
please check out that respective skill where we walk through sitting at both
source and
destination NAT and verify it all of it together.
So here, as we have the destination NAT in place, we can test our gateway rules
from the
outside trying to get down to the server, Web 10.
So for the NAT rule, we'll go ahead and call this Web SRVR and the type of NATs
can be
destination NAT.
So for the source address, I'm going to leave that wide open so we could have
any possible
source address.
And then if they're trying to go to the destination address of 23.1.2.181. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then if they're trying to go to the destination address of 23.1.2.181.
So put that here as the initial IP address that the customer is trying to reach
.
So that's 23.1.2.181.
And if that happens, we want to translate that to the IP address of the Web 10
server, which
is 1010.181.
So the translated address is going to be 10.10.0.181.
And currently I have two edges out here, edge one and edge two.
So I'm going to go ahead and also specify that that's where I want that to be
applied
to, to both of my logical interfaces on tier zero.
And that's edge one and edge two. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's edge one and edge two.
And also behind the scenes, I've got a virtual IP address of about 60 that we
're using on
that gateway zero as well.
So for the NAT rule for the destination NAT, we'll apply it to these two
interfaces, click
on apply, and then scroll down and click on save.
So there's our destination NAT rule.
Also let's edit that one more time.
I'll show you something else pretty cool.
And the details for this NAT rule, check out where it says firewall.
It says, what do you want to match on the external address for this NAT rule or
the internal
address?
And so by default, it's matching the internal address.
So if we set up rules based on IP addresses with our gateway firewall, we'll WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we set up rules based on IP addresses with our gateway firewall, we'll
want to specify
for this web server, either its group membership or its internal address of 10
10 zero 181.
But we have options to control that behavior right here if we want to.
So we'll leave the default of matching on the internal address.
We'll click on save again.
And then we should test it to verify that it's working.
So let's go out to this mint 23 VM here will verify its IP address.
And we should be able from here to reach out to the IP address of 2312181 and
with the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
with the
destination NAT rule that should forward our traffic down to the web 10 server.
So let's verify that next.
However, I just realized I don't have an open console to this mint 23 VM.
Let's go back to the vSphere client and open up a remote console.
So here's our mint 23.
Let me go ahead and right click and we'll just launch a remote console and
bring that
up.
All right.
So here is mint 23.
Let's verify its IP address.
We'll bring up a command prompt to do that.
So here let's type in if config just to verify its IP address 23.1.2.74 out WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here let's type in if config just to verify its IP address 23.1.2.74 out
here on the 23
network.
So if we did a ping to 23.1.2.181 that is the IP address where we have the
destination
NAT rule here on our tier zero gateway.
So if we try to ping that address, we should have destination NAT change the
destination
address here on our tier zero gateway to the 10 10 zero 181 address.
And that would cause it to forward down here to gateway A who would forward it
down to
the VM and the response would come back in that reverse path.
So let's go ahead and do a ping real quick.
And that works.
That looks pretty good.
Also while we're here, let's try an SSH session down to 23.1.2.181. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Also while we're here, let's try an SSH session down to 23.1.2.181.
And so this little VM here is really, really old.
So let me go ahead and let's use the telnet trick.
I'm still going to tell that to 23.1.2.181.
But instead of using the well known port for telnet, which is 23, I'm going to
put in
the IP address at 22 press enter.
And if that server is listening on port 22, we should get some response similar
to this.
So I just want to verify that we have connectivity there on port 22.
And let's also try HTTP by opening up a browser right here on this client out WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's also try HTTP by opening up a browser right here on this client out
on the 23 network.
So to do that, we'll click on the icon for the browser and we'll put in the IP
address
at 23.1.2.181.
I'm going to be using HTTP because I don't have HTTPS services here on this
little web
VM, so we'll test it by using a browser to 23.1.2.181.
We'll press enter and boom, this is the web page for that little web 10 server
right
there.
And the reason it's showing the address there is because that took a moment to
edit the
index.html file on that little web server. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
index.html file on that little web server.
That's why it's showing up with that IP address.
That way when we hit that server, we'll know exactly where that content is
coming from.
It's coming from this little web 10 server right here.
So we've tested connectivity from this Mint 23 machine down to the server,
which also confirms
we have nullity connectivity, but also that the destination that is working.
The last thing I want to do is verify Mint 20, so we deployed that earlier, let
's go
ahead and power it on.
So here for Mint 20, it's showing us the IP address at 10.0.153.
We'll verify that at the VM itself and we'll also verify we have basic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll verify that at the VM itself and we'll also verify we have basic
connectivity.
So here is VM 20.
We'll open up a command prompt and we'll type in IF config just to confirm the
IP address.
Sure enough, it is at 10.0.153, which is what it said right here on the vSphere
client.
Fantastic.
So we'll do a trace out to 8888 and that looks good.
I'll stop that.
Just want to make sure we're going out to the internet and let's also verify we
can
reach our web 10 machine right there, which is at 1010 0 181.
And we'll try that right here from Mint 20.
So we'll do a ping to 10.10.0.181, press enter and that's working. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll do a ping to 10.10.0.181, press enter and that's working.
Let's also just to confirm we're connected to the right device.
Let's also bring up a browser and here at the browser, we'll go to 10.10.0.181,
press
enter and sure enough, that is working.
So now that we've verified our basic connectivity in the next video, let's
begin our configuration
of Gateway firewall and we'll start here on Gateway 0.
[BLANK_AUDIO]