In this video, we're going to set up the routing so that these two tiers are
all gateways.
If they're trying to forward traffic from the perspective of site three down
here to
the 1044 address space or from site force perspective over here to the 1033
address
space that instead of saying that traffic naked just out to their service
provider using
the default route that instead of doing that, they should go ahead from a
routing perspective
and use the next top address of their good buddy on the other side of that
logical network
that we just set up.
So from T zero's perspective over say three, the next top address to reach 1044 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So from T zero's perspective over say three, the next top address to reach 1044
would
be 10343444 and from the T zero's perspective in site four, if it wanted to
reach the 1033
address space, we need to train it that is next top should be 103434.33.
So at the end of the day, the traffic still will be going through our service
provider
and just look like traffic going back and forth between 23123 and 241240.
The two ends of the IPsec tunnel and the payload for all the user traffic going
back and forth WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
over that tunnel will all be encrypted and it'll just be inside of an ESP
payload.
And there's more than one way of implementing the routing to make this happen.
One option is to use border gateway protocol, for example, with dynamic routing
.
But for the purpose of this set of videos, we're going to use static routing so
we can
focus most of our attention on the IPsec and not a whole giant discussion once
again
on setting up BGP. But if you do want to see a big discussion on BGP, check out
our previous
skill on that exact topic.
So for now, let's implement the static routes here on the T zero at site three WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So for now, let's implement the static routes here on the T zero at site three
and the T
zero here at site four.
So let's begin at site three.
So we'll go to networking and we want to modify the routing on our T zero
gateway.
So on the left hand side, we'll click on T zero gateways.
There's our red site three T zero gateway.
We'll click on the three dots and then from the menu, we'll click on edit right
there.
Then we'll scroll down, we'll go to the routing section, expand that.
And then currently it has two static routes.
We'll click on that hyperlink for two because we are going to make an WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll click on that hyperlink for two because we are going to make an
additional static
route. So we currently have a default route going out through our service
provider.
We have a route that's involved with our site to site policy based VPN tunnel
we set up
in the previous skill and we want to add one more.
So we'll click right here and add static route.
So here at site three, we'll call this static route.
We'll call it to site for subnets.
And for the destination target network, let's use 10 dot 44 dot anything.
And that way, if at site four, they want to make additional subnets under 1044,
for example, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for example,
1044 one or 1044 two, this static route will simply cover anything that starts
with 1044
as we only care about matching on the first two octets right there.
And then for the next top, we'll click right here on set and then we'll click
here on set
next tops and we're going to take a look at our diagram once again.
So what we want to do is we have specified for this route, the 1044 anything.
We want to use the next top right here.
So that's what we're going to put as the next top for this static route on the
T zero
gateway at site three.
So for the next top, it's going to be 10 dot 34 dot 34 dot 44 just like that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So for the next top, it's going to be 10 dot 34 dot 34 dot 44 just like that.
And then furthermore, I'm going to go ahead and lock that down just to be used
with our
IP succession.
So here we have an option of selecting a whole bunch of different interfaces.
And I'm going to choose our site for IP, second VPN session as the scope for
this specific
route.
And then we'll click on add, then we'll click on apply, then we'll click on
save, then
we'll click on close, now scroll down and click on close editing.
And so since we just implemented that additional static route, let's also just WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so since we just implemented that additional static route, let's also just
take a moment
and verify that the active edge node currently has that new route.
And because I currently have a console open to that from our previous
discussion, let me
just hit the up arrow key and do a get forwarding for the VRF for our services
router.
We'll press enter and scroll up.
And here we go.
So there's our new route.
So previously, we didn't have a route for the 1044 anything.
So now we do and the next top is 10343444.
And now we need to do a similar treatment over at site four, still make a road WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And now we need to do a similar treatment over at site four, still make a road
trip over
to site four.
It's in dark mode.
We're going to go to the NSX manager for site four.
So with networking selected on the left hand side, we'll go down to our tier
zero gateways
right there.
And we're going to edit the details for our site for tier zero gateway by
clicking on
the three dots.
I'll collapse this on the left.
So we have a little more room to work with.
Click on three dots, click on edit, and then we'll go down to our routing
section.
We'll expand that.
And currently we have one static default route. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And currently we have one static default route.
So we'll click on that link and we'll add a second route.
So we'll go ahead and click on add static route.
We'll name this two site three subnets.
And let's go ahead and use a summary route of 10 dot 33 dot zero with a 16 bit
mass that
way in the future.
If site three wants to have additional subnets under 1033 like 1033 one and two
and so forth,
this route will still cover all those.
And then we'll go ahead and set the next top.
So we'll click here on set in the next tops column right there.
And we'll click on set next tops.
And for the next top, we want that to be 10 dot 34 dot 34 dot 33. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And for the next top, we want that to be 10 dot 34 dot 34 dot 33.
And let's confirm our topology real quick.
And that is the IP address right here on this logical network between the tier
zero at site
four and the tier zero at site three.
So that looks good.
And it's also set the scope here for just the two site three IP, site VPN
session.
And then we'll click on add.
And then we'll click on apply and save and close.
And then we'll click on close editing.
And let's also go to the CLI on the active edge node over at site four to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's also go to the CLI on the active edge node over at site four to
verify its
route as well.
So as far as which device that is, let's go ahead and take a look at the
network topology.
We'll go ahead to our site for tier zero gateway.
We'll double click on it.
And that confirms for us here that it's edge two, which is the active note.
And if we click on edge to there, it'll show us that its management address is
dot 67.
So let's do an SSH session over to dot 67.
So here we are at edge two, all typing get gateways just to find the VRF that's
being
used by the services router and which is VRF one, so we'll type in VRF space WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
used by the services router and which is VRF one, so we'll type in VRF space
one, press
enter and then let's do a get route and press enter.
And we just want to confirm here we have our static route for the 1033 anything
with
the next top of 1034, 3433, which we do.
That's great.
And from right here, we should be able to ping some IP address over at the 1033
address
base.
Let's do a ping to 10 dot 33 dot 0 dot one.
That's cheating a little bit because we know that address exists.
That's the interface address for that logical segment over on the left hand
side.
We saw that as the default gateway address that our red VM used for its first WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We saw that as the default gateway address that our red VM used for its first
top.
So if we press enter and sure enough, we can reach that.
That looks good.
So now that we've configured the details for our site to site route based VPN
and we've
also now implemented routing, our next logical step is to verify whether or not
these VMs
on the 1033 network and 1044 network respectively, whether or not they can
actually reach each
other.
So we'll do that verification and also some additional CLI verification in the
very next
video.
there in just a moment.