All right, so for our game plan for IPsec route-based VPNs
between two tier zero gateways at two different sites,
one of our first steps is gonna be to validate
our existing topology and configuration
just to make sure we have these addresses involved
to begin with and that the VMs
that those respective sites can get out to the internet.
So our first step will be to validate our existing topology
just to make sure we know what we currently have in place.
Then as far as our configuration goes,
we then wanna go ahead and configure all the details
that we need here at site three WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we need here at site three
for the route-based IPsec VPN tunnel
we wanna create over to site four.
So over here we'll say site three.
And as part of that,
if we don't have a VPN service currently enabled
with our tier zero gateway, we'll need to create one.
And based on our previous skill
where we did an IPsec policy-based VPN
between this tier zero and an external router.
And in that previous set of videos,
we did the tunnel out to a third party Cisco router.
So the T zero here at site three already has a VPN service, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the T zero here at site three already has a VPN service,
but what it does not have is a VPN session
that is gonna be used to connect over to site four.
So we'll use the existing VPN service
and we'll create a brand new VPN session from site three
that we're gonna use over to site four.
And as part of that, we're gonna need to set up an identity.
So the identity we're gonna use here at site three
is gonna be its globally reachable IP address.
And that's gonna be 23.1.2.30.
And as far as the tunnels go,
the I tunnel and the IPsec tunnel,
let's go ahead and use the default profiles for those.
So when we connected to the Cisco device, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So when we connected to the Cisco device,
we had to customize and tweak a few of those profiles.
But here, because we're going from one NSX environment
to another, if you use the same default profiles
on both sides, all the policies and parameters should match.
And then once we've configured site three,
we'll then go ahead and configure
a similar configuration over on site four.
And because on site four, we have not yet created
any VPN tunnels or IPsec services yet.
We'll need to start up a VPN service
and associate that with the tier zero gateway
over here at site four.
We'll then also need to set up a VPN session WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll then also need to set up a VPN session
from the perspective of site four
that's gonna connect over to site three.
And so for its ID, we're gonna use
its publicly readable IP address for all of its local IDs,
24.1.2.40.
And we'll also use the default profiles once again,
because if we use the default profiles at both locations,
all the parameters for the initial I tunnel
and the IPsec tunnel, they'll all match up.
So I'll make a little note there that'll be for IKE
and IPsec.
And then once we have the VPN sessions
set up on both sides, we also need to make sure
we set up routing.
So we had a separate set of skills on OSPF routing WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we had a separate set of skills on OSPF routing
and also on BGP routing.
And instead of setting up dynamic routing for this topology
because we wanna focus on the route based VPNs themselves,
let's just go ahead and do static routes.
Which also reminds me we need to have a plan together
regarding the network, the logical network
that we're gonna place between site three and site four
as part of our IPsec configuration with route based VPNs.
So let me go ahead and draw in this logical network
right here.
And for this logical network, let's use the addressing space
of 10.34.34.0. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of 10.34.34.0.
And over here, let's use 33 for that endpoint and 44 over here.
So when we set up our static routes at this T0 gateway
here at site three, we'll say, hey,
there is T0 gateway to get to the 1044 network.
In fact, we could use a summary route and say 1044 anything.
So we could say here at site three,
hey, to get to the 1044 anything,
the next top is gonna be 103434.44.
And that would cause the T0 gateway
to route that specific traffic from here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to route that specific traffic from here,
for example, going over here over that logical network.
And that's where IPsec is gonna be implemented
on any traffic going over that network.
And then similar logic over here at site four,
we'd tell the T0 gateway over here
to get to the 1033 anything, the next top from your perspective,
Mr. T0 at site four,
is gonna be the next top of 103434.33.
Which once again would route that traffic
over this logical network.
And as a result, would also be protected by IPsec
as it goes across.
So what the internet would see on this public network right here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So what the internet would see on this public network right here,
they would just see traffic going back and forth
between 23, 1, 230 and 24, 1, 240,
with all that traffic encrypted.
Now initially, when they negotiate the Ike tunnel initially,
they're gonna be using UDP port 500.
And if we're going through NAT, which we're not in this case,
but if we're going through NAT, it'd be UDP 4500.
That'd be for the negotiation setup of the Ike tunnel.
And then the actual ESP traffic is protocol number 50
for the encapsulating security payload.
Effectively encrypted protected IPsec traffic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Effectively encrypted protected IPsec traffic
that's going back and forth between the two sites.
And then of course, the last step after we've set all this up
is to go ahead and test and verify it, which we'll do as well.
So with this game plan in mind,
I'm super excited about the next step
and that is to validate our existing topology
to make sure that it is accurate and functioning.
So in the next video, let's begin with exactly that
and we'll verify our existing topology.
So I'll see you in the next video in just a moment.