So one of our first steps in getting an IPSect tunnel up and working between
these two endpoints is to make sure that this T0 gateway is connected to this
external VLAN78 and that it has the edge IP addresses and virtual IP address
associated with that external network.
So let's make a road trip over to the NSX manager and let's put that external
connectivity in place.
So this is the interface for the NSX manager and because it's not being managed
by a global manager, we can do all of our work right here.
So to start off, let's go to networking and let's take a peek at the network WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So to start off, let's go to networking and let's take a peek at the network
topology as it currently is.
So I've got this red T0 gateway here.
I've got a directly connected segment.
We've got some VMs connected to it and I have some external interfaces on the
10210 network.
So what we need to do is create a new external segment for VLAN78 and then we
'll add a couple new interfaces, one for edge one and one for edge two to
connect to that new external VLANs.
So to do that with the networking tab selected on top under connectivity on the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So to do that with the networking tab selected on top under connectivity on the
left, we'll go down to segments and let's create a new external segment for V
LAN78.
So we'll click on add segment right there.
We'll name this external VLAN78 and for the transport zone, let's grab our lab
three red VLAN transport zone right there and we'll specify for the VLAN right
here that it's VLAN78 and that's it.
So we'll click on save and then for that segment, that's enough configuring for
right now. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we have this segment called external VLAN78 that is associated with VLAN78.
Next, let's go to our tier zero gateway and specify that we want to use our two
edge nodes to connect to that external network segment.
So with networking still selected, we'll now click on tier zero gateways.
Here is our red tier zero gateway.
So to do that, we'll click on the three dots next to our red tier zero gateway
and from the menu, we'll click on edit.
So in edit mode here for the tier zero gateway, let me collapse the left hand
side a little bit.
We'll go down to the interfaces. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We currently have two.
We'll click on that hyperlink and we'll add a couple more.
Actually, before I do that, it looks like I have a typo right there.
So this says E2 for edge two, VLAN81, 82, but the IP address is 62.
I'm just going to edit that so the name matches.
I'll click on edit and that really should say 62 in the name of that interface.
So I'll correct that.
Scroll down, click on save and then collapse that.
That looks a lot better.
So now with that update, let's create two new interfaces, both of them for VLAN
78. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
78.
So we'll click on add interface.
This will be for edge one, VLAN78 and the address we want to use on edge one
for VLAN78 is .61.
And we'll put in that IP address right now before we forget, which is 78.0.0.61
with a 24-bit mask.
And we're going to connect that over to the external VLAN78 just like that.
And we want to use edge one for this.
So we'll select edge one from our available edge nodes.
And that looks great.
So we'll scroll down, click on save and then we'll repeat that process for edge WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll scroll down, click on save and then we'll repeat that process for edge
two also on that 78 address space.
So we'll click on add interface.
This one we'll call E2 for edge two, VLAN78.62.
And then over here we'll put in the IP address, which is 78.0.0.62 with a 24-
bit mask.
And then for the segment we're connecting to, that's the external VLAN78.
And for the edge node, the only available edge node left is edge two right
there.
So we'll select it and that looks good.
So we'll scroll down, click on save and let's check our work.
So here is the first one and that is 780061. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here is the first one and that is 780061.
Here's the second one, 780062.
That looks great.
So we'll go ahead and close that and click here on close editing.
And let's take a look at the topology by clicking here on network topology.
So there are our four external interfaces too are on VLAN 21 based on the IP
dressing and the ones on the outside here,
the 780061 and 780062 are the ones that I just added.
So to confirm basic connectivity to our gateway, we could go to our gateway
itself and try to ping outbound from there on the 78 network WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
itself and try to ping outbound from there on the 78 network
or we could go to our top of rack switch and ping from there coming in.
So before we test basic connectivity, let me verify that I have some IP address
to ping to on my top of rack switch.
So let me bring in that switch.
Here it is.
And let's do a show IP interface brief is a Cisco Kettle Switch.
I'll say please exclude anything that has the word unsigned in it.
All right.
So on VLAN78, I do have an IP address.
All right.
So so we should be able to ping from our tier zero gateway. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This IP address 780099 because it's also in VLAN78 or we could also go ahead
and ping from the switch right here down to those two addresses.
Let's try that as well.
Ping over to 78.0.0.61.
It will do 780062 and that's working.
That's great.
And it's also tries actually we haven't set the virtual IP address.
So that's going to fail until we get our virtual IP address set up.
So let's go ahead and set up that virtual IP address and then we'll try that as
well.
So back to our tier zero gateway and then we'll edit our tier zero gateway and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So back to our tier zero gateway and then we'll edit our tier zero gateway and
then for the HAVAP, we'll go ahead and click on the hyperlink there.
And we've got one for the 21 network.
Let's go ahead and add a VIP configuration and that IP address is going to be
78.0.0.60 based on our plan.
Let's check out our plan real quick.
So we're right here.
Sure enough.
We want to use a virtual IP address of dot 60 on that 7800 network for the T
zero gateway.
And that's what we're setting up right now.
So 780060 with a 24 bit mass that looks good.
And then for the interfaces involved, we want the ones on the 78 network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then for the interfaces involved, we want the ones on the 78 network.
So that's edge one on VLAN 78 and edge two on VLAN 78 perfect perfect.
And then we'll click on add and that looks good.
We'll click on apply, click on save.
And now we should be able to ping that virtual IP address as well from the
external switch and verify that here's the ping we tried just a moment ago and
now for that same ping.
No problem.
We're good to go.
That verifies connectivity from effectively our edge nodes on behalf of the
tier zero gateway out to the physical network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
tier zero gateway out to the physical network.
And if we want to verify it in the other direction as well, what we could do is
let's go take a look at what our management IP addresses for our edge nodes.
So to do that, let's close our editing first and then we'll click on system and
on the left will open up fabric, click on nodes.
And I seem to confirm what the IP addresses on node one.
So node one right here to make go ahead and clean up some of the columns.
I don't need that and I don't need that and I don't need that.
So edge one is at 192.168.1.36. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's s is each over there and take a look from its perspective.
So here we are connecting over to dot 36.
That's edge one fantastic.
Let's do a get gateways just to confirm what's there.
So we here's our services and distributed router for red T zero.
Let's go into VRF two by typing in VRF two, it's our services router.
So you get route press center.
So there's our directly connected T zero route 7800.
And if you do a get forwarding, I also need to configure a route on this tier
zero gateway to tell it, Hey, if you ever need to forward a packet over to the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
zero gateway to tell it, Hey, if you ever need to forward a packet over to the
1080 network address space, forward it over with the next top of my Cisco
router.
So if you look at the topology, that's going to be 7800 dot 10.
So while we're at it right here, let's also set up a specific route going over
to the 1080 network.
So the tier zero gateway won't try to use this default route, which is going
out a different interface.
So even though we're doing policy based VPNs, don't ever forget that we still
need routing in place for our traffic to flow. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So back at the NSX manager, if we go back to networking and then we go back to
our tier zero gateways, we'll edit our existing tier zero gateway by clicking
on the network.
And we'll go down to the routing section right here.
And we'll click on the link for static routes.
So currently there's a default route that we saw at the command line.
And we want to add one more.
So this one is going to be route to Cisco subnet.
And that subnet is the 10.8.0 network with a 24 bit mask.
And the next hop is going to be our Cisco router address that's reachable. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the next hop is going to be our Cisco router address that's reachable.
And that is 78.0.0.10 and leave the 80 as one and click on add and click on
apply and click on save and then click on close and scroll down, click on close
editing.
And since we have the command line open at our tier zero gateway, let's just
verify that we have the route there as well.
So here if we have the up arrow key and we do a get forwarding.
Now we have a specific route for that 1080 network. We didn't have that a
moment ago.
So this is the output of get forwarding. We could also do a get route and that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this is the output of get forwarding. We could also do a get route and that
would also reveal that as well.
So here is our static route for the 1080 network with the next top of 780010.
So currently we have our T zero set up with this additional connection.
Now we verified basic connectivity to the top of our switch.
We added a static route to say, Hey, to get to the 1080 network.
Your next top is this Cisco router.
And there's actually one other thing I want to check and that is my NAT rule.
So currently I've got NAT to allow this VM here to go out through the other
service provider through VLAN 21. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
service provider through VLAN 21.
And I don't want to have any NAT applied for traffic from this VM as is going
over the IP sec tunnel over to the Cisco router.
So let's just double check the net rules and make sure we're not including NAT
accidentally on the traffic that's supposed to go over the tunnel.
So to verify that back at the NSX manager, we click on networking and then on
the left go down to net.
And here is our NAT rule. Let's take a look and sure enough, this says 10,
anything.
Go ahead and do this translation.
So let me go ahead and edit that real quick and we'll add that net role and say WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let me go ahead and edit that real quick and we'll add that net role and say
, you know what?
We only want this source net to apply if it's going through the two interfaces
on VLAN 21 and not if that traffic is going through the VLAN 78 interfaces.
So with those other two selected, we'll click on apply and scroll down, click
on save.
And now, NAT won't be applied for traffic from our VM if it's going over the
VPN tunnel towards the Cisco router.
Based on the static route that we put in a moment ago.
So now that we have the basic connectivity to this extra segment that we're
going to need for our IP sec tunnel, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going to need for our IP sec tunnel,
in the next video, let's focus our attention on the configuration of this Cisco
router.
So we'll do that in the next video and I'll see you there in just a moment.