So for our first stop in our game plan,
it is to make sure that our existing topology has
reachability at these respective IP addresses and that
the VMs at those respective sites can get out to the Internet
just to confirm that Nat and everything else is currently working.
So with that in mind, let's start here at site 3.
So here is the NSX manager for site 3 and let's go to system.
And with system selected on the left-hand side,
let's expand fabric and let's just take a look at our node real quick to make
sure
they're edge nodes and they are up, they look good to go. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
they're edge nodes and they are up, they look good to go.
And let's also peek in on our hosts as part of site 3.
So we'll expand this cluster and looks like our hosts are up as well.
All right, fantastic.
Let's also verify our IP addressing this news on our tier 0 gateway here at
site 3.
So we'll click on networking and then under connectivity, we'll click on tier 0
gateway.
And let's go ahead and expand the tier 0 gateway, go down to interfaces.
And currently has four.
Why does it have four?
Oh, I know.
Has two that we set up for the IPsec policy base VPN that we're doing to an WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Has two that we set up for the IPsec policy base VPN that we're doing to an
external device.
And then I've got two here on VLAN 23.
So their IP addresses are 231231 and 231232.
And then we also have a virtual IP address for this gateway.
So right here, where it says HAVIP, we'll click on that hyperlink where it says
two.
And sure enough, we have the global address 231230 right there, which is being
supported
on the back end by edge one and edge two.
Let's also take a peek at our segments.
So here at site three, we'll get on segments.
We have a site three subnet 33, which is using the 1033 address base. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We have a site three subnet 33, which is using the 1033 address base.
So that looks good.
And let's go verify that a client of VM on that network segment can get out to
the internet.
So here is the vSphere client for site three.
And here is a VM called red one and red two.
And let me take one of those and rename it.
So I'll right click and go to rename right there.
Let me call that site three red VM and click on OK.
And let's go ahead and power that VM on as well.
And let's bring up a web console that'll be a little bit bigger and easier to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's bring up a web console that'll be a little bit bigger and easier to
see.
So in the top left hand corner, we're at the site three red VM.
Let's type in if config or ethernet zero.
Just to confirm it has an IP address, let's type in route dash and confirm it
has a default
route and let's do a ping.
Let's do account of five out to www.vmware.com and press enter and that's
looking good.
All right.
So it looks like site three is good to go.
We could also do a trace route.
I'll say no name resolution and let's say a maximum number of hops of five and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'll say no name resolution and let's say a maximum number of hops of five and
let's
go out to Google at eight dot eight to eight press enter.
And here I just want to verify that indeed we are going out through the correct
service
provider and that's at 23 dot one dot one.
And that's the service provider who's supporting site three also back here at
the NSX manager
for site three.
I just want to verify our current situation regarding IP sec because we did set
up an
IP sec tunnel to an external router.
So let's go to networking on the left.
We'll click on VPN and sure enough here we have let me collapse that way a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll click on VPN and sure enough here we have let me collapse that way a
little bit
more room.
Here we have our VPN service that we use for that site to site VPN tunnel.
So that's the parent service that's enabled on the T zero gateway.
If click here on IP sections, here's our session to our external Cisco router.
And that looks like it is currently working.
So if we were to bring in our client real quick and if we were to do a ping for
example
out to 10 dot eight dot zero dot 10, which is going through that tunnel over to
the external
router over the IP sec tunnel and press enter that traffic should be going over
the IP sec
tunnel.
We can verify that right here with you statistics for the IP [garbled] session going WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can verify that right here with you statistics for the IP [garbled] session going
to the Cisco
router.
And sure enough there we have some packets in and out if we click on refresh
because
the ping is still happening that should be incrementing and it is that looks
great.
Let's we'll click on close there.
And one other thing we can do while we have this up is let's go take a look at
some of
those details at the CLI for the active edge node.
So to determine who's the active edge node, let's go ahead and back to our top
ology here
at site three by clicking on network topology.
Let's double click right here on the T zero gateway. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's double click right here on the T zero gateway.
That'll show us the fabric and if we zoom in, this is showing us that edge one
is the
active node and edge two is standby.
So edge one if we click on here once.
So this is the management address for edge one who's currently active.
So let's take a moment and go over to that device with SSH and just take a peek
from
the command line.
So here we're logged on to the edge one device over at site three and if we do
a gate gate
ways and press enter.
Here's our services router for the tier zero gateway and we go into that VRF
with VRF
space one and do a get route press enter that'll show us the routing table. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
space one and do a get route press enter that'll show us the routing table.
So there's our default route going through our service provider A and here's
the specific
workaround for IP sec tunnel.
And so from here we should be able to ping 24 dot 1 dot 2 dot 40, which is the
reach
well IP address over at site four.
Let's verify that as well and that looks good too.
Fantastic.
We'll do a control C and let's exit out of the VRF one and from here, let's do
a get
IP sec VPN, let's do a question mark and let's go ahead and type in session and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
IP sec VPN, let's do a question mark and let's go ahead and type in session and
press enter.
So here's our current IP sec session that we set up in our previous skill and
this is
going between the site three tier zero gateway and our external router.
So as part of that configuration, because it's policy based here are the policy
rules
effectively saying traffic from 1033 zero going to 1080.
Go ahead and encrypt it.
It also implies that traffic coming from 1080 coming into 1033 zero should be
decrypted
and there's the local on remote IP and peer IDs in use for that connection. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and there's the local on remote IP and peer IDs in use for that connection.
And one of the benefits of looking at this output here at the CLI is that as we
start
to add additional IP [garbled] sessions, including a route based IP [garbled] session, we
can compare
and contrast the differences between the route based IP [garbled] session and the
policy based
IP [garbled] session.
So now that we've taken a peek at site three and verified it, let's also do a
quick check
over at site four.
So here is site four.
I'm going to be using dark mode on site four for both the vSphere client and
also for
the NSX manager to help us differentiate the two. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the NSX manager to help us differentiate the two.
So back here at the vSphere client, let me go ahead and grab a VM that's
currently on
our subnet 44.
And we go ahead and grab this guy right here and I'm going to rename it to make
it easier
to identify.
So we'll right click from the drop down menu, click on rename and let's rename
this site
for violet VM.
So that's just going to be a little helpful reminder with red as site three and
violet
as site four.
So we'll rename that VM appropriately.
So also go ahead and power it on. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So also go ahead and power it on.
And let's also go ahead and open up a console just to verify it has access out
to the internet.
So I'll do a web console from a little bit more real estate here so we can see
it a little
bit better.
So from the top left, we're at site four violet VM as to I have config for
ethernet
zero to verify it's IP address will type in route dash and let's also do a
trace with
a dash in for no name resolution.
And let's go through a maximum number of hops of let's say eight and we'll go
to Google
dot com's love air fight DNS for us.
It also verify real internet access for us. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It also verify real internet access for us.
And that looks great.
So there's the default gateway address.
Here's our service provider over at site B and although this address looks like
it's
a global dress, it's just one I'm using my lab environment.
So I'm actually looping back through my 192 168 with some additional net
happening and
it's going up to my real service provider and the next few hops into my service
provider,
which is Cox communications here in Las Vegas and it's going out to points
beyond that as
it goes up to the final destination once to two, et cetera, right here.
So it's one of verify that we're going out to the correct service provider here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So it's one of verify that we're going out to the correct service provider here
on this
VM over at site four and that we have internet access and all that looks great.
So here at site four, who want to confirm who the active edge node is.
We could go ahead and click on networking, then go down to our topology and
then here's
our tears are okay.
We could go ahead and just double click on that and that's going to confirm for
us who
the active is.
So here at site four, the active node is edge to self who want to confirm.
It's details.
We could go ahead and click on it here that we give us the IP address it's at WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We could go ahead and click on it here that we give us the IP address it's at
and then
we could SSH there as well.
If we wanted to check out details regarding edge two.
So at the moment edge two, if we go down here to VPN, we don't have any VPN
services
enabled at all anywhere here at site four.
And as a result, we also are not going to have any IP [garbled] session set up, but
we'll
change that as we implement our IP [garbled] services.
So as far as our game plan is concerned, we have validated our existing to
apology.
We also verified that we have basic connectivity between those two IP addresses
because of
our site three at the CLI on the edge node, we were able to ping 24 dot 1 dot 2 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
our site three at the CLI on the edge node, we were able to ping 24 dot 1 dot 2
dot 40
just to confirm connectivity there.
And we also verified from each of the VMs respectively, that they could get out
to the
internet.
So our next stop in our journey then is to go to site three and begin the
implementation
of our IP [garbled] site route based VPN tunnel between site three and site four.
So I'll see you in the next video as we begin our configuration for IP [garbled] site
site VPN
tunnels here on site three.
[BLANK_AUDIO]