So let's go through the process of configuring the green VRF
Tier 0 gateway, the green T1 gateway, this segment,
and some VMs, and then we'll test to verify we have access from those VMs out
to the Internet.
So here in the NSX Manager, let's go to Networking and click on Network Top
ology and take a peek.
So currently we have this beautiful infrastructure for blue that's currently in
place,
and we want to basically replicate that for the green VRF, which we'll add
right now.
So as part of that, let's go ahead and create the segment first for VLAN 24 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So as part of that, let's go ahead and create the segment first for VLAN 24
that we're going to be connecting the green VRF 2.
So on the left, we'll click on segments, we'll click on Add Segment,
we'll call this EXT for VLAN 24, and that'll be the VLAN we're using for this
external VRFs connection
up to the external gateway.
And that's going to be a VLAN back segments, we'll choose our VLAN back segment
transport zone.
And then for the VLAN, we're going to put right here VLAN 24 and click on Save.
And then we'll click on Nose, so now we have that external segment. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we'll click on Nose, so now we have that external segment.
So in our topology, that little segment is right here.
Let me zoom in, it is right here.
So now that we have that segment, let's create a new green VRF.
So to do that, with the Networking tab still selected, we're going to click on
Tier Zero Gateways on the left
and click on Add Gateway, and from the dropdown, we're going to create another
VRF.
So we'll click here on VRF, we'll call this green VRF,
and then we'll associate it with our parent Tier Zero Gateway from the dropdown
.
It's the only Tier Zero Gateway that we have, that's not a VRF, so we'll select
it.
Then we'll scroll down and click on Save. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Then we'll scroll down and click on Save.
And then let's continue editing it because we also want to implement network
address translation
and also a default route on this Tier Zero green gateway.
So let's go ahead and click on Yes.
So now that we're still configuring a Tier Zero Gateway, let's configure its
interfaces.
So we'll expand interfaces, click on Set, and let's click on Add Interface,
and let's call this Edge 1 on VLAN 24, and that's going to be connecting to our
segment,
External Segment VLAN 24.
And for the Edge node, we're going to go ahead and use Edge 1, and its IP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And for the Edge node, we're going to go ahead and use Edge 1, and its IP
address there is going to be 24.1.2.61
with a 24-bit mask, and that all looks good, so we'll scroll down and click on
Save.
Then we'll click on Add Interface, and we'll add another interface for Edge 2.
So there'll be Edge 2, VLAN 24.
We're going to connect that to our external segment that we just made, External
VLAN 24,
and the IP address we're going to use on that edge as we connected that
external segment
is going to be 24.1.2.62 with a 24-bit mask, just like that, and we'll scroll
down and click on Save.
And what did I forget? Oh, I forgot to specify which Edge node, so this is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And what did I forget? Oh, I forgot to specify which Edge node, so this is
going to be Edge 2,
so we'll choose Edge 2, scroll down and click on Save.
All right, that looks good.
So we'll click on Close, and also while we're here, let's also add a default
route.
So we'll go to Routing, and for Static Routes, we'll click here on Set,
and we'll click on Add Static Route, and we'll say Default, and then we'll go
ahead and put in the default route of 0,
0, 0, 0, slash 0, and then set the next top to be 24.1.2.1, and click on Add, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
0, 0, 0, slash 0, and then set the next top to be 24.1.2.1, and click on Add,
and Apply, and Save,
and Close, and let me go ahead and close editing there.
And let's go over to Edge 1 and just verify the details for that new VRF.
So here as we log into Edge 1, we're going to start off with a Get Gateway's
command.
So we'll type in Get Gateway's press Enter, and there is our Tier 0 green VRF
right there.
And it is VRF #16, so we type in VRF #16, and then here in VRF #16, if you will
get route and press Enter,
here we have our default route with the next top of 24.1.2.1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here we have our default route with the next top of 24.1.2.1.
Also, while we're here, let's go ahead and ping 24.1.2.1 just to verify that we
are on the right subnet,
and that looks good.
Always a good sign if you can ping the next top of your default route.
So next, let's create our green Tier 1 Gateway A, and we'll associate that with
our Tier 0 green VRF.
So to do that here on the Networking tab, under Connectivity, we're going to go
down to Tier 1 Gateways,
and we'll click on Add to add a Tier 1 Gateway.
And let's call this green T1 short for Tier 1, and let's call it Gateway-A. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's call this green T1 short for Tier 1, and let's call it Gateway-A.
And then we'll associate that with our Edge Cluster.
So for the linked Tier 0 Gateway, we're going to choose our green VRF.
And also while we're here for this Gateway, let's also do route advertisement.
And that way, any networks that we connect to this Tier 1 Gateway,
those networks can be advertised up to the parent, which is our green VRF.
So we'll enable that as well, and let's click on Save.
And let's click on Note.
And let's also verify our topology by clicking here on Network Topology.
And here it is over here on the left, let's zoom in a little bit. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And here it is over here on the left, let's zoom in a little bit.
So there's our green VRF, and then we have our Enter Router link down to our
green Tier 1 Gateway A right there.
Also, what I noticed is it doesn't show any DHCP services yet,
so let's go ahead and enable DHCP services here as well.
So we'll go back to our Tier 1 Gateways.
We'll edit our green Tier 1 Gateway A by clicking on the three dots,
clicking on Edit, then over on the right, we'll click here on Set next to DHCP
Config.
And we'll specify that we want to be a DHCP server,
and more specifically, we want to use this Profile, and then click on Apply. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and more specifically, we want to use this Profile, and then click on Apply.
And that way, when we create the segment, we can go ahead and use Gateway-based
DHCP services
to provide our IP addressing.
So we'll scroll down, click on Save, and that looks good, so we go ahead and
click on Close Editing.
So now we are a green Tier 1 Gateway A.
And the next thing we want to do is connect it to a segment.
So our next logical step then would be to create our segment.
We'll call it Green Segment 10, and then for the Logical Layer 3 IP address for
the default gateway for that segment,
let's use 10.10.0.1 with a 24-bit mask. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's use 10.10.0.1 with a 24-bit mask.
And for the Transport Zone, it's going to be an overlay transport for Green Se
gment 10.
So let's go ahead and choose an Overlay Transport Zone that is being supported
by all of our Transport Nodes.
So we'll choose the Hour A, B, Overlay.
And let's also make sure we connect this Green Segment 10 to the right Tier 1
Gateway.
So we want to connect it here to the Green T1 Gateway A.
We'll select that.
And then also let's set up DHCP services as well.
So we'll click here on Set DHCP.
We want to go ahead and use Gateway DHCP server.
And then we'll put in the range here of 10.10.0.151 through 10.0.1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we'll put in the range here of 10.10.0.151 through 10.0.1.
And then let's set up a fairly short lease of like 500 seconds.
And then for DNS services, let's use 8, 8, 8, 8, and that looks good.
And then we'll click on Apply.
And then we'll scroll down and we'll click on Save.
So now that we have this Tier 1 Gateway and it's connected to this segment,
let's go ahead and take a look at our topology by clicking on Network Topology.
So here is our blue VRF and it's T1 and it's couple segments. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here is our blue VRF and it's T1 and it's couple segments.
And over here on one of its segments, it's using the 10, 10 address space.
But here on the green VRF, which is right here, connected to our Tier 1 Gateway
,
still as part of that green VRF.
And now we have the green segment 10.
This network segment 10.10.0 with the 24-bit mask is different.
And in a different VRF, then the one over here, which is under our blue Tier 1
Gateway.
And that's the benefit of having our VRFs is that we have separate containers,
if you will,
for groups of routes, one for each customer or one for each tenant. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for groups of routes, one for each customer or one for each tenant.
So now that we have this all set up right here, let's go ahead and add a VM
and put it right here on the green segment 10.
So to do that, let's head over to the vSphere client.
And over here on the vSphere client, I currently have Mint 10 and Mint 20.
They are both connected to the segments as part of the blue VRF.
So let me go ahead and choose, let's choose Cali 10.
That's another Linux box.
Let's go ahead and first of all, make sure it's on the right segment.
So we'll right click, click on Edit Settings and for Cali 10, let's go ahead
and put that
specifically over on the green segment 10 right here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
specifically over on the green segment 10 right here.
So it just shows up looking like a port group here, which is like the network.
And that's the overlay segment called green segment 10.
We'll click on OK and we'll click on OK.
And then we'll go ahead and power that up.
And as it powers up, we'll also launch a remote console so we can take a look
at it.
So we'll click here on Launch Remote Console.
So here is that virtual machine right here that is coming up.
And the first thing I want to do is just verify its IP address.
And let's also verify it can get out to the internet.
All right. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
All right.
So here is the desktop.
Let's open up a command prompt and let's type in if config.
Or we could also an IP space address and that would show us as well.
So this is 10 10 0 1 84 and if you do a ping out to 8 8 8 8.
Survey says.
Survey says that is not flying.
Let's do a tracer out and I'll tell it to not bother doing name resolution out
to 8 8 8 8 and.
And sure enough, we are making it through the first top there, which is the 10
10 0 1.
And that's the IP address on our green tier one gateway A. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's the IP address on our green tier one gateway A.
So let's take a look at the topology and determine what could be wrong.
So we're sitting on a VM over here on this segment segment 10.
I don't know if we're on post A or on host B, but that part doesn't matter.
We're over on this segment.
So we'd be using our default gateway and that should be forming up here.
And then this should be forwarding it up here.
Oh, I just realized what the problem was.
We we did not on this external gateway, which is at 24 dot 1 dot 2 dot 1.
We did not have dynamic routing going on between here and here with BGP to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We did not have dynamic routing going on between here and here with BGP to
advertise, for example, reachability to this 10 10 network.
So for clients over here on this segment, they're trying to get out.
They're going to use the default gateway of 10 10 0 1 and it's going to go to
the tier 0 V or F green in this case.
And then out.
So a couple of things that it could be number one on this tier one gateway.
If we didn't say advertise the routes for directly connected networks, that
would cause this tier 0 gateway to not have knowledge about how to reach the 10
10 network.
Or if we did that and the packets actually getting up here, this router does WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Or if we did that and the packets actually getting up here, this router does
not know how to get back to the 10 10 network.
And that's because we're not yet setting up routing between this VRF and an
external BGP speaker.
So there's no way by default that this external router would know how to
forward back.
So here's what I propose we do. Let's verify that on this gateway, the tier one
gateway that we are advertising our routes up to the green VRF tier 0 gateway.
And then secondly, let's implement that right here and list that anything
coming up.
If the source address is 10, let's map it to 24 dot 1 dot 2 dot 60. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If the source address is 10, let's map it to 24 dot 1 dot 2 dot 60.
That is currently available here in my topology.
And that way as that traffic goes up to this router, it'll look like it's
coming from 24 1 to 60.
And because this router is directly connected to that network segment, it can
respond back.
So let's check out both of those items starting here at the tier 1 gateway A to
make sure that we are advertising our routes.
So if we go to our tier 1 gateways and we go to our green tier 1 gateway A and
click on the three dots and click on edit and scroll down to route
advertisement.
Oh, I did advertise. All right. So we are advertising our routes up and we can
verify that by going to the VRF for green and just verify that the 10 10 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
verify that by going to the VRF for green and just verify that the 10 10
network shows up.
So let's head over for a moment to edge one. We'll type in gate gateways and
press enter.
So for our green VRF, it is VRF 16. Let's go ahead and change into that VRF by
typing in VRF 16.
And let's do a get route and press enter. And sure enough, it knows about it.
And that's because at the tier 1, we were advertising that route.
So the next problem we're going to solve is this router being able to route
back to the 10 10 network.
And instead of having to do that, let's just do net right here at the green VRF WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And instead of having to do that, let's just do net right here at the green VRF
to make all the traffic that's coming from the 10 address space.
Down here to make it look like it's coming from the netted address of 24 dot 1
dot 2 dot 60.
So back at the NSX manager with the networking tab selected on the left, we're
going to scroll down under network services and click right here on net.
And it says you were in the middle of changing something and I say no.
And let's just take a look. I click here and close editing to make sure I'm not
leaving anything open. Fantastic.
So now let's go over on the left hand side and go down to net. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So now let's go over on the left hand side and go down to net.
And we want to do this on our green VRF. So on the gateway, we're going to use
the drop down and choose the green VRF right there and then add net rule.
So I'll minimize the left hand side there and I'll call this G net for this
rule as part of the green VRF.
We want to use source net and a traffic that is coming in that begins with 10
anything.
We want to go ahead and translate that to 24 dot 1 dot 2 dot 60 based on our
plan.
And then I'm going to also click here on set and apply that to these two
interfaces, although we could leave that off. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
interfaces, although we could leave that off.
It was still function on those two. But if we had multiple interfaces and only
want to do net on one or the other, this is how you could go ahead and choose
just one of the interfaces.
So I'll go ahead and choose both of them, click on apply and scroll down and
click on save and make sure that flies.
That's fantastic. And let's go back over to the network topology.
So here is our green T1 gateway A above that we have our green VRF with two
services.
And one of those is the net rule that we just implemented.
So let's verify the client that is sitting right here on segment 10. Let me WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's verify the client that is sitting right here on segment 10. Let me
expand that real quick.
That is the Kali 10 machine. Let's make sure that can get out to the internet
now.
So let's scootch him over here. So here is the Kali 10 virtual machine.
I also want to make darn sure that this is really the machine I'm looking at.
So let's just do a real quick I have config press center and for its ethernet
zero interface, the Mac address the layer two dress ends in F 754.
So I'm just going to verify that that literally is the last four characters of
the Mac address by clicking on that virtual machine here in the topology view, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the Mac address by clicking on that virtual machine here in the topology view,
clicking right here on virtual interfaces and verifying the IP address 10 10 0
184 and the last four characters here of F 754.
All right, that looks great. So we'll close that.
So I make sure I'm on the right VM and then let's go ahead and hit the up arrow
key a couple times and do a trace route again.
And sure enough, we are making it all the way out to the internet.
So if we did a ping to www.vmware.com and press enter name resolutions working
internet connectivity working. It's all great.
So we'll do a control C and as a result, we just implemented and verified the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll do a control C and as a result, we just implemented and verified the
full implementation of a new VRF in this case, VRF green.
And we tested it from a VM here going out to the internet.
So thanks for joining me in this set of videos and in the skill regarding using
the VRF light in the world of NSX.
And I'll see you my friend in another skill very, very soon.
Until then, I hope this has been informative and I'd like to thank you for
viewing.