Hello and welcome. My name is Keith Barker.
And in a previous skill, we walked through the process of setting up a policy-
based IPsec VPN tunnel
between a Tier 0 gateway in the world of NSX and a third-party external router.
However, that is not the only option for setting up an IPsec-based site-to-site
VPN tunnel.
Another option is what's called a route-based VPN.
And here's the big difference between those two types, policy-based and route-
based.
With policy-based, we're specifying in the session information the networks, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
With policy-based, we're specifying in the session information the networks,
the exact networks that we want to protect.
For example, this network here, over to this network here.
And by specifying what those networks are, that is our effective policy for our
policy-based IPsec tunnel.
So what is the other option? The other option is a route-based VPN with IPsec.
And with a route-based IPsec VPN tunnel, the big difference is we now are going
to have a logical network segment
between the two sites.
And then with that logical network statement, we can set up routings.
So at any time the gateway needs to forward traffic over that logical IP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So at any time the gateway needs to forward traffic over that logical IP
network between the two sites,
that traffic automatically gets encrypted.
So in the future, if we add two or three or a dozen routes at one site and a
dozen or more routes at the other site,
as long as those routes are believed to be reachable over that logical network
between the two peers,
all that traffic can be encrypted.
So part of the magic for a route-based IPsec VPN tunnel is the creation through
the IPsec session
of a logical VTI, a virtual tunnel interface on each of the gateways that are WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of a logical VTI, a virtual tunnel interface on each of the gateways that are
going to support this logical network segment
between the two sites.
And here's the great news.
In this set of videos, I'd like to walk you through the logic of how that works
.
I'd like to put a game plan together with you to actually implement it.
And then together, we'll follow that game plan to implement and verify an IPsec
route-based VPN tunnel
between two gateways to NSX gateways that are two different sites.
So if you're ready, I'm ready.
I'll see you in the very next video.