So now that we have a couple of segments connected to this tier one gateway,
let's go ahead and add a VM to each of those.
So here in the vSphere client,
let's go ahead and click on the VM and templates view,
and let's go down to VMs for testing,
and these guys are D should be client.
So Mint 10, let's take that one,
we'll right-click, click on Edit Settings,
and let's place that over on segment 10.
So we'll browse for the network adapter placement,
and let's place that on segment 10, click on OK,
click on OK, and then we'll go ahead and power that up.
And let's do the same thing for Mint 20, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's do the same thing for Mint 20,
but we'll put it on segment 20.
So we'll right-click on Mint 20, click on Edit Settings,
from the details for the network adapter, we use the dropdown,
we'll browse for the port group to use,
we'll choose Blue Segment 20, click on OK, click on OK,
and then power that up as well.
And then we'll also open up remote consoles to each of those.
So let me go ahead and launch a remote console to Mint 10,
and also open up a remote console to Mint 20.
So if we go back to our topology view here,
and we click on Refresh right there in the NSX Manager, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and we click on Refresh right there in the NSX Manager,
this should now show us that we have those two VMs
right there, which we do.
We've got Mint 10 right here on segment 10,
and we have Mint 20 sitting here on segment 20.
And because we have DHCP services enabled
on both of those segments, both of these clients
should be able to get IP addresses in the correct submits.
So let's verify that together.
Here is Mint 10.
Let me just confirm I'm on the right VM.
I am, there's Mint 10.
We'll go to a command prompt, and we'll do an IF config,
and it has the IP address of 10.0.183.
Fantastic, let me move that over to the right a little bit, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Fantastic, let me move that over to the right a little bit,
and let's bring in Mint 20.
So here's Mint 20, and so on Mint 20,
let's go to a command prompt to do an IF config,
and we are at 10.20.0.165, that looks great.
So Mint 10 is at 10.10.0.183, Mint 20 is at 10.20.0.165,
and let's verify they can get out to the internet.
So I ping to www.google.com press enter.
(laughs)
And now we start the troubleshooting portion of our show.
That is not flying, so DNS resolution is failing, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That is not flying, so DNS resolution is failing,
and let's just do a ping out to 8888, and that's failing.
Now let's do a trace path, we'll do a dash M
for no name resolution out to 8888,
and let's see how far we get.
Okay, so we're making it to our default gateway,
and then we're forwarding it up over the router
to router link between our tier one gateway
and the blue VRF, but it looks like past that.
We are not getting to the external network,
and I don't think it's a routing problem
because we have a default route.
Let's just double check real quick. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's just double check real quick.
So here on edge one, let's do a gate gateways,
just to verify the VRF number for a blue VRF,
so it's 11, let's do a VRF space 11,
the prop changes to represent where we are,
and we'll type in get route and press enter,
and we do have a default, so that part looks good.
Oh, I know what we don't have, we don't have NAT.
(laughs)
Let's take a look at our topology.
So in our topology, if this is Mint 10 right here,
and it's forwarding traffic to its default gateway,
and then it forwards it to the blue VRF,
this blue VRF does have a default route WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
with the next top of 23.1.2.1,
however, what it doesn't have is NAT configures.
So this external router right here,
when it's receiving a packet from 10.10 anything,
it has no clue on how to reach it,
because we haven't set up dynamic routing, first of all,
between this VRF and the external network.
So if we wanted to, we could do BGP.
So we could set up BGP
between each of the tier zero VRF devices
and an external BGP router,
and that way we could dynamically exchange
routing information.
And currently as of NSX version 4.1, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And currently as of NSX version 4.1,
if we are using a VRF tier zero gateway,
it does support BGP, and that's great,
but it doesn't support OSPF.
However, from a routing perspective,
we do have a default route that goes out this way,
but the problem here is this device
has no idea how to forward the traffic back.
So let's do this.
On this tier zero blue VRF,
let's specify that we want to do NAT,
and that way when we try to ping
or reach this device right here,
the external router,
it'll look like we're coming from 23.1.2.
So let's use .60 as a mapped address
that we can use for any traffic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we can use for any traffic
that's sourced from 10 anything.
And that way when we try to ping this gateway,
or when this gateway tries to return packets to us,
it'll believe that the traffic is coming
from the 23.12 network,
and it can forward it down to our blue VRF tier zero gateway,
who can then untranslate it,
and then forward it back to our client.
So let's implement NAT right here on our blue VRF.
And for more details on configuring source
or destination NAT,
please check out our skill dedicated to that concept
as part of NSX.
So for now we're gonna reinforce that skill
by simply adding network address translation right here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
by simply adding network address translation right here
on our blue VRF tier zero gateway.
So to implement network address translation
for our blue VRF tier zero gateway,
we're gonna click here on networking,
and on the left under network services,
we're gonna click on NAT.
So with NAT selected,
we're gonna click on add NAT roll,
but I wanna make sure that we're on the right gateway.
So we wanna do NAT on our blue VRF.
So that is currently selected.
I'll click on add NAT roll,
and let's call this blue NAT.
And for the type of NAT, we wanna do source NAT, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And for the type of NAT, we wanna do source NAT,
and any traffic source from 10, anything.
So I'll put 10.0.0.0/8.
So any source IP addresses to be in with 10,
we're gonna go ahead and translate them over to,
let's use 23.1.2.60.
And then furthermore,
even though it's not required,
we can specifically say which interfaces
we wanna do the NAT on.
So if we want to perform this on either edge,
we can select all of them here,
or you can actually leave it blank,
and it would automatically do that by default,
without selecting the specific interfaces.
But to make it nice and tight and clean,
I'm gonna go ahead and choose both those interfaces WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'm gonna go ahead and choose both those interfaces
for the NAT rule, click on apply, and let's check our work.
So if traffic is coming in from the 10, anything,
and it's being routed out of those two interfaces,
we're gonna use source NAT,
and swap out the source address of whatever it was coming in,
with this source address 23.1.2.60,
which is in the same subnet out there on the 23 network.
So with that in place, let's scroll down,
click on save, and make sure it's implemented,
we'll click on refresh there, that looks great.
Let's click on the stats icon right there.
And look at that, I have active sessions already in place, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And look at that, I have active sessions already in place,
that could be DNS requests,
or other things that those clients are doing.
So now that we have NAT in place right here,
let's go back to our VM and test.
So here is Mint 10, so a moment ago,
it didn't complete the trace path, let's do it again,
I announced going out there.
So we'll do a control C, and let's also do a ping
to www.google.com press enter,
and that also verifies that name resolution is working as well.
So that's for VM Mint 10, let's also try it from Mint 20,
play a movement 10 over to the left here a little bit,
and let's bring in Mint 20. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and let's bring in Mint 20.
So here is Mint 20, and let's try a ping out to www.vmware.com,
and that's working as well.
So name resolution is working,
connectivity after the unit is working, that looks great.
And if we wanted to configure border gateway protocol
for a specific VRF, it's pretty simple to do.
So with networking selected, we go to Tier Zero Gigways,
we go to our blue VRF, click on the three dots,
and then click on edit.
And then from here, we scroll down,
we go into the BGP section, enable it,
and then furthermore specify the details for BGP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then furthermore specify the details for BGP.
Also since we're right here, let's just go ahead
and do it as an example.
We've also had a previous skill on setting up BGP
and dynamic routing, so for more details on setting up BGP,
check out that previous skill as well.
So for a demo right here for our T0 gateway,
this is our blue VRF.
Let's go ahead and use the local autonomous system
at 6783, and for BGP neighbors right here,
we'll click on set, and let's click on add BGP neighbor,
and I can set up a little external router at 23.1.2. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and I can set up a little external router at 23.1.2.
And let's use .11.
And for that remote AS, let's use 3560,
and then scroll down and click on save.
And then we'll click on refresh here,
and then we'll click on close, and then we'll click on save.
So right now, if we went to the BGP neighbors
and clicked on that link right there,
currently showing that neighbor is down
because they don't have that neighbor yet configured.
However, I've got great news.
Let's go ahead and configure a device at that IP address
on the 23.1.2 network as a BGP neighbor.
And we'll advertise a route just to confirm
that our blue VRF is dynamically learning via BGP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that our blue VRF is dynamically learning via BGP.
So let me go ahead and close that.
I'll scroll down and close editing.
And what I'm gonna add right here is on this segment,
a little Cisco device acting as a router.
It'll be an autonomous system 3560,
and it'll be at the IP address of .11
on the 23.1.2 network.
And then I'll go ahead and specify that I wanna peer
with either .61 or .62 or both,
because those are the two IP addresses of our edge nodes
providing that external connectivity.
And again, the tier zero autonomous system number WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And again, the tier zero autonomous system number
I set up was 673.
So with that in mind, let's make a quick road trip
out to this device right here,
which is a Cisco catalyst multi-layer switch,
and we'll configure its IP address
and do a quick configuration of BGP and advertise route
just to verify that the BGP is working
with this specific VRF.
So here on the external 3560 multi-layer switch
is to a quick, go IP interface brief.
And we'll also say include any output that has 23 in the line.
So there is our logical VLAN 23 interface at 23.1.2.11. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So there is our logical VLAN 23 interface at 23.1.2.11.
Let's also verify that we can ping 23.1.2.61
just to make sure we're on the same network, which we are.
And let's do show IP protocols.
So a show IP protocol shows there's no dynamic routing protocols,
including no BGP.
So we'll go into configuration mode
on this multi-layer switch from Cisco and we'll type in router,
BGP, and we want to use autonomous system 3560, enter.
So that's our ton of system number.
And we want to set the neighbor at 23.1.2.61.
That's edge one.
And that's the neighbor remote autonomous system WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's the neighbor remote autonomous system
of 673, we'll press enter.
And with any luck, we should have a neighborhood.
There it is, that's fantastic.
We can also set up a pairing with edge two as well.
And we'll do that by putting in a neighbor statement for edge two.
And that should pop up as well here in a moment.
And there it is, that's fantastic.
And let's go ahead and advertise the network.
So here in BGP configuration mode on this device,
let's type in network 888880 with a mask of 255.255.255.0. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's type in network 888880 with a mask of 255.255.255.0.
And BGP is only going to advertise that network if it exists.
So let's also create a loopback interface here on the Cisco device
by typing an interface loopback and let's use 88.
And we'll give it the IP address of 88.88.88.something.
Let's go ahead and use 88 there with a 24-bit mask.
So now that we have that network ended and exist,
that network should now be advertised over to our blue VRF.
And we can verify that right here as well
by going to one of our edge nodes, let's go to edge one.
And here at edge one, let's do a gateways. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And here at edge one, let's do a gateways.
So for this VRF right here, the services router for VRF blue,
which at the moment is using our VRF 11.
So let's type in VRF 11 to go into that VRF.
Let's do a gate route, press enter.
And sure enough, there is our BGP learned route right there.
So the B indicates we're learning it via BGP, fantastic.
And we are learning about the 888888 network.
And the next top is our BGP neighbor over at 23.1.2.11.
We can also do a gate, BGP space question mark. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can also do a gate, BGP space question mark.
And let's go ahead and type in neighbor and press enter.
And that's going to show us our BGP neighbors.
So here's our BGP neighbor at 23.1.2.11.
And the remote AS of 3560.
And if we do a get a little question mark BGP and a question mark.
And we type in IPV4 and a question mark and press enter.
That'll show us our IPV4 routes that we've learned via BGP.
Once again, there's the 88 network.
Just confirming that we have our BGP neighborship set up
between VRF blue, that tier zero gateway,
and the external BGP neighbor.
So the cool thing is that from a BGP routing perspective, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the cool thing is that from a BGP routing perspective,
we can have the blue VRF tier zero gateway pair with one BGP neighbor.
And we can have our other VRFs pairing with yet different BGP neighbors.
Again, keeping all the routes separate.
So any of the routes in the blue VRF are going to stay in the blue VRF.
And any routes over here in the green VRF are going to stay in the green VRF.
[BLANK_AUDIO]