One of the really cool things about networking is that once we have an
objective in mind,
sometimes there's like two or three different ways of accomplishing that.
So if we had three sites, for example, sites three, four and five here,
and we had some VMs at each of those sites,
and we wanted to enter communications between them.
For example, this VM could talk to this VM,
and this VM could talk to this VM, as well as here and here.
We have a few options for implementing that.
One would be setting up NSX federations,
and then having a stretched segment that all three of the sites could access, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then having a stretched segment that all three of the sites could access,
then we could place the VMs on that stretched segment, that would be one option
.
Or we could implement site-to-site VPNs, for example,
between site three and site four, and between site four and site five,
and also between site five and site three,
and then place the correct routes on the Tier Zero gateways and provide the
routing functionality.
That would also allow the VMs at each site to communicate security or the
public internet
with each other by leveraging the IPs.x site-to-site VPNs that we set up.
And in this guild, we're going to take a look at yet another way
that we can allow devices at different geographical sites WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we can allow devices at different geographical sites
to be able to go ahead and communicate with each other,
and that's by using a layer two VPNs.
So let's imagine these three network segments, one at site three, one at site
four, one at site five.
Let's imagine that we want to go ahead and have a logical, one giant, layer two
broadcast domain
that is shared by site three, site four, and site five.
So here's what we could do. We could take those three overlay segments,
one at site three, one at site four, one at site five.
So to begin with, these are all isolated from each other. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So to begin with, these are all isolated from each other.
Think of them like little islands with their VMs that are attached.
However, what we can do is set up layer two VPNs,
and we can logically create one shared segment.
That, when each of the VMs at the respective sites connected at segment,
they're all on the same logical layer two broadcast domain,
as well as a corresponding common layer three IP network address space.
And the big picture regarding how this works is we're going to set up one of
our sites
as a layer two VPN server. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
as a layer two VPN server.
In fact, let's go ahead and color code that.
And let's imagine that site three, we're going to set up as the layer two VPN
server.
So put that right here, site three is going to be the L two VPN server.
And then we have a couple other sites, site four and site five.
So let me put site four right here.
And site four will act as an L two VPN client.
So we'll put site four right there and then for site five, which I'll put right
here.
And then we set up an L two VPN session between the server at site three and
the client at site four. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the client at site four.
Then we also set up a second L two VPN session between the server.
Once again, at site three and the client here at site five.
Now, to pull this off, there's virtual tunnel interfaces that are created
at the server and at the clients.
And there's a logical network set up between them.
So behind the scenes, it's using GRE for that.
So the yellow here represents the L two VPN session and the green represents
the virtual tunnel interfaces
that are the termination point for the logical network between the server and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that are the termination point for the logical network between the server and
the clients.
And then to tie all this together, we're going to take each of these segments
and we're going to associate them with our layer two VPN service.
So this segment over here can be called site, for example, called site three
segment 99.
It's just a locally significant name.
And then over here at site four, we could call this S four segment 99.
And over here at site five, we call it S five dash SAG 99.
So it's just a local segment and a local name at each of the sites.
But it's the linking it to the layer two VPN service, which causes these three WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But it's the linking it to the layer two VPN service, which causes these three
separate segments
at each or three sites to logically become one layer two broadcast domain.
So on top of that entire network address space, let's say we want to use the
addressing space of 10 dot 99 dot zero dot zero with eight
24 bit mask. And as far as D should be services go, we can set up D should be
services at one site or all three sites.
And then for that common segment, we could have a default gateway, for example,
at top one,
then any VMs we place on the segment over at site three or on a segment over at WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
then any VMs we place on the segment over at site three or on a segment over at
site four.
Effectively, they're always sitting on that same layer two broadcast domain and
on the same IP subnet of 10 99 zero.
So our tunnels between the sites would be from the server here at site three
over to site four.
And another tunnel over to site five. Now, one of the things we want to avoid
doing whenever possible is the send sensitive data,
including packets containing sensitive data over an untrusted network, such as
the internet.
So also, as part of the implementation of our L2 VPNs, it's also going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So also, as part of the implementation of our L2 VPNs, it's also going to
implement IP sec.
So as traffic is being sent back and forth between these sites behind the
scenes, IP sec is being leveraged as part of the layer two VPNs to protect the
packets as they're being sent.
So from this public networks perspective, if they were to capture the traffic,
all they would see is ESP traffic that's being sent between the endpoints at
site three,
for example, in site four or between site five and site three. And they wouldn
't have access to any of the encrypted payload information because they wouldn't
have the keys to unlock that data and make sense of it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
have the keys to unlock that data and make sense of it.
So with layer two VPNs, we can take segments on each of our sites and logically
create one giant broadcast domain, but it's not limited to overlay segments.
We can also include VLANs or a combination of VLANs and overlay segments and
merge them together into one giant broadcast domain by linking them to the L2
VPN service.
So having this feature called the layer two VPNs in the NSX environment is a
super useful tool.
If we ever need to combine VLANs and or overlay segments across multiple WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If we ever need to combine VLANs and or overlay segments across multiple
geographic sites and have them appear as one logical network.
So to really appreciate this, one of the best things to do is to see it in
action.
So in the next video, let's take a moment and let's put a game plan together
specifically for what we want to accomplish with layer two VPNs and then with a
game plan in place.
We'll then proceed to the configuration and verification of layer two VPNs in
an NSX environment.
So I'll see you in the next video for the game plan.
[BLANK_AUDIO] WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
[BLANK_AUDIO]