With our topology confirmed,
let's begin our configuration of layer 2 VPNs starting here at our L2 VPN
server,
which is going to be implemented here on our T0 gateway at Site 3.
As part of that process,
we'll enable two VPN services,
one for IPsec, one for L2 VPN in server mode.
Once those services are enabled here at the T0 gateway,
we'll then proceed to configuring an L2 VPN session between Site 3 and Site 4.
As part of that is going to ask us about what is the logical network address WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
As part of that is going to ask us about what is the logical network address
space we want to use
for the virtual tunnel interfaces and the logical network between, for example,
Site 3 and Site 4.
So, for the addressing, let's use 1.22.16.99.30 with a 28-bit mask here at Site
3.
Then, when we configure Site 4 as an L2 VPN client,
it'll go ahead and automatically assign one of the IP addresses from that same
subnet.
So, this is the subnet 16 with the range of 17 all the way through 30.
And we're just using the last IP address in that subnet here on the T0 gateway WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we're just using the last IP address in that subnet here on the T0 gateway
at Site 3
for this end of the tunnel, for this VTI right here.
And as I mentioned, when we get to Site 4,
it'll go ahead and dynamically assign an IP address from that same subnet for
that end of the tunnel.
All right, so let's head over to the NSX manager over here at Site 3.
So, here at the Site 3 NSX manager,
let's go to the networking tab up on top and on the left, under network
services,
we'll click right here on VPN.
So, our first task is to create two VPN services,
one to support IPsec, which is being used by our LTVPans. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
one to support IPsec, which is being used by our LTVPans.
And then the second service we're going to create is for the LTVPans service
itself.
So, we'll click right here on add service at Site 3.
And let's create the IPsec service first.
So, we'll select IPsec from the dropdown,
and then I'll collapse the left-hand side to give us a little bit more room.
And let's call this Site 3 IPsec for this VPN service for IPsec.
We'll associate this service with our T0 gateway.
And then we'll leave everything else to their defaults and click on save.
And we'll click on no, and let's create one more service. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we'll click on no, and let's create one more service.
And that's going to be our LTVPans service.
So, with VPN services still selected, we'll click once again here on add
service.
This time from the dropdown, we're going to choose the LTVPans server.
So, we'll click on that.
We'll call this Site 3 LTVPans.
Associate that service also with our Tier 0 gateway here at Site 3.
So, the hub and spoke is disabled by default.
But if we want to connect, for example, two or more LTVPans clients,
and we want all those client computers on those LTVP and connected segments WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and we want all those client computers on those LTVP and connected segments
to be able to communicate with each other,
we need to propagate any of those messages from one segment to the other spokes
.
So, if we enable hub and spoke, that'll allow that to happen,
to create one giant layer to broadcast domain across the server,
and all of the spokes with segments associated with the LTVPans.
So, I'm going to set the hub and spoke to enabled,
and then take all the other defaults, and then we'll click on save.
So, we'll click on node.
So, now here in the VPN section on Site 3 and NSX Manager,
with VPN services selected, we have two VPN services, IPsec, and one for L2VPN. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
with VPN services selected, we have two VPN services, IPsec, and one for L2VPN.
We can also confirm that by going to our network topology.
And then here at our T0 gateway, we hover over services.
You'll notice it has two VPN services.
One of those is the IPsec, and the other is the L2VPN.
Think of it like the gateway being willing to support those services.
Now, they're not really going to be used until we set up sessions regarding
them.
So, let's go back over to the VPN section here on Site 3.
And with VPN selected, let's go to our next section right here, L2VPN session. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And with VPN selected, let's go to our next section right here, L2VPN session.
So, also behind the scenes, what's really important to be aware of is that,
when we set up an L2VPN session, it's also going to create an IPsec session
to protect the traffic going back and forth.
So, right here, if we go to IPsec sessions, there's nothing here yet.
But when we go through the process of creating an L2VPN session,
it's automatically going to create an IPsec session as well.
So, be prepared for that to show up right here once we're done with config. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So, be prepared for that to show up right here once we're done with config.
So, with L2VPN session selected, we'll click right here on Add L2VPN session.
And then from the dropdown, because the Site 3 is going to be the server,
and we enabled the VPN service for our L2VPN server,
we're going to choose that type of session.
So, we'll choose from the dropdown L2VPN server, and we'll call the Site 3 L2
VPN server,
just like that. And it's server mode based on what we chose from the dropdown.
And now it's asking us, "Hey, what service do you want to associate this with?"
And we want to associate this with the VPN service for L2VPN that we created WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we want to associate this with the VPN service for L2VPN that we created
earlier.
So, we'll choose that single option, Site 3 L2VPN VPN service.
Then we're going to specify the local endpoint.
So, here on Site 3, because we deleted our local endpoints,
we can go ahead and simply create another one by clicking on the three dots
right here.
And here at Site 3, the local endpoint is going to be our globally reachable IP
address,
which is 23.1.2.30.
So, we'll click here on Add Local Endpoint.
I'm going to go ahead and name this 23.1.2.30. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'm going to go ahead and name this 23.1.2.30.
That way, when I see the name or the address, it'll be the same.
And then for the actual endpoint address, I'll put 23.1.2.30.
And then I'm not using any certificates.
And for the local ID, we could also plug in that IP address again.
However, if we leave the local ID blank, it'll just use that IP address that we
're using
as the local endpoint for the local ID as well.
So, I'm going to go ahead and just let that assume that IP address right there
for the local ID.
And as part of configuring this local endpoint, check this out. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And as part of configuring this local endpoint, check this out.
It's asking what VPN service we'd associate this with.
And this is our Site 3 IPsec.
So, this endpoint is going to be used as part of an IPsec tunnel in combination
with the L2 VPN.
And that way, it's going to be using IPsec to protect the traffic going back
and forth.
So, we'll click on Save.
So, here's the name of our L2 VPN session.
Here's the mode, which is Server.
Here's the VPN service that we're using to support it.
Then we're using this local endpoint of 23.1.2.30.
And then for Site 4, the remote IP address is going to be 24.1.2.40. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then for Site 4, the remote IP address is going to be 24.1.2.40.
In fact, let's take a look at our topology just to confirm.
So, here in our topology, we want to appear with 24.1.2.40.
So, that's what we'll put in as the remote IP address from the perspective of
Site 3.
So, we'll put in 21.2.40.
Fantastic.
And we're also going to be using a pre-shared key for the authentication part
of the tunnel.
So, I'm simply going to put in a passphrase there.
And if we click on the eyeball, I'll show you what I put in Cisco,
Exclamation Mark 2.3 with the capital C at the beginning.
And that's the pre-shared key that's going to be used behind the scenes with IP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's the pre-shared key that's going to be used behind the scenes with IP
sec
for the authentication of the tunnel.
And then for the remote ID, we can just leave that blank if we want to,
because it'll just pull by default the remote IP address,
up here 24.1.2.40.
And it'll use that for the corresponding remote ID.
And then over here on the right, it's asking us for the tunnel interface.
So, once again, we're creating a virtual tunnel interface,
an illogical IP network segment between us here at Site 3
and the destination for this L2 VPN session, which is over at Site 4. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and the destination for this L2 VPN session, which is over at Site 4.
So, for that virtual tunnel interface, I would like to use this IP address,
172.16.99.30 with this last 28.
And so, the range of that subnet is 17, as far as usable addresses,
all the way through 30.
So, let's put in this IP address right here for the virtual tunnel interface
that we're going to be using at Site 3.
So, there is the tunnel IP address that we want to use.
And the cool thing is, when we configure a client,
it'll automatically pull an IP address from that same subnet WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it'll automatically pull an IP address from that same subnet
to be used on the client side of that logical network connection.
And then we'll go ahead and click on Save.
It's asking if we want to continue configuring.
I'll go ahead and say no to that.
So, now we have this L2 VPN session created and check it out.
Behind the scenes, it also created for us an IP [garbled] session
over to that same destination.
And it's using the IPsec to protect the traffic.
So, when you set up an L2 VPN session, think of it like a two-for-one.
We have the L2 VPN session as well as a corresponding IPsec session.
Now, at the moment, it shows as down, do-be-do-down, down. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, at the moment, it shows as down, do-be-do-down, down.
And that's because we haven't yet configured the other side.
And when I say other side, I mean, we haven't configured yet any clients.
So, in the next video, let's continue our configuration by moving over to Site
4
and configuring it with two VPN services, one for IPsec, one for L2 VPN,
but this time client mode.
And then we'll proceed to configure an L2 VPN session
from Site 4 going over back to Site 3.
So, I'll see you in the next video as we begin the configuration here
on Site 4 as a client.