So when we left off, we had configured Site 3 as an L2 VPN server,
and now we're going to turn our attention to Site 4 here,
and it's Tier 0 gateway to configure Site 4 as an L2 VPN client.
So let's head over to the NSX Manager here at Site 4,
and for convenience sake and also for determining which one we're on,
I've also set up Site 4 NSX Manager in dark mode,
while Site 3 is currently in light mode.
All right, so here we go.
This is Site 4.
If we go to the Networking tab for the NSX Manager here at Site 4, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If we go to the Networking tab for the NSX Manager here at Site 4,
and let's just take a look at our network topology to start off with.
So we'll click on Network Topology,
and currently we have our Tier 0 gateway right here with three services running
.
None of those are VPNs, so let's go ahead and start the configuration
by creating a couple of VPN services here at Site 4,
one for IPsec and the other four L2 VPN.
So to do that, on the left-hand side with Networking still selected at the top,
on the left-hand side, under Network Services,
we'll click right here on VPN.
And let me go ahead and collapse this left-hand side. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let me go ahead and collapse this left-hand side.
This will remind us exactly where we're at right there.
And let's create our two VPN services that we're going to need.
So we'll create the first one, and it really doesn't matter which order you do
these in,
but they do both have to exist before we set up the L2 VPN session.
So let's do the IPsec first, and we'll go ahead and call this one Site 4 IPsec.
And for the gateway we're going to associate this with,
we're going to go ahead and select our only gateway,
which is our Tier 0 gateway, and click on Save.
And then we'll go ahead and do that once more, but this time for the L2 VPN.
But this time at Site 4, we're going to choose the L2 VPN client VPN service. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But this time at Site 4, we're going to choose the L2 VPN client VPN service.
And we'll call the Site 4 L2 client.
And then for the gateway we want to associate this with,
once again, those come here, Tier 0 gateway at Site 4,
and we'll click on Save.
Then we'll click on No.
And now we have our two VPN services, one for IPsec,
one for the L2 VPN client.
And then we're going to move over to L2 VPN sessions and begin our
configuration.
Now, very similar to what we did at the server, if we go back here to IPsec
sessions,
there's nothing here yet.
But once we're done with the config of our L2 VPN sessions,
we're going to have our L2 VPN session from Site 4 over to Site 3. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we're going to have our L2 VPN session from Site 4 over to Site 3.
And we're also going to have a corresponding IPsec session
that's being used to protect and encrypt our traffic as it's going between Site
4 and Site 3.
So with L2 VPN session selected, let's click on Add L2 VPN session.
And then from the dropdown, because we enabled a VPN service of L2 VPN client,
and that's what we want Site 4 to be from the dropdown,
we'll choose L2 VPN client right there.
And then I call this L2 to Site 3. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it'll just remind me when I see this session, what it's doing.
So this is the L2 VPN session over to Site 3, and we're in client mode.
And for the VPN service, we're going to associate this with the VPN service
called Site 4 L2 client.
That's our local endpoint here at Site 4.
And then the remote endpoint is over at our server, and that's at Site 3.
And that's at 23.1.2.30.
And then check this out, the magic for the client happens here.
Instead of having to put in all the additional details and the VGI information WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Instead of having to put in all the additional details and the VGI information
and so forth,
all we need to do for the L2 VPN session and what's going to be the
corresponding IPsec session
is put in the name, specify the service we're going to tie this to,
the endpoints involved, and then we are going to copy and paste
the peer configuration from the server.
So right here, we're going to go ahead and right click and then paste the
exported information
from the server regarding the peer config.
So because I don't yet have that in my buffer, let's go back over to the server
just for a moment at Site 3.
And let's download the information we need so we can paste it in right here on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's download the information we need so we can paste it in right here on
the client.
So just to make sure that you and I are on the same page here, we are currently
at Site 4.
We're going to hop over to Site 3 just for a moment, get the information we
need, put it in my buffer,
and then paste it in over here at the client.
So back here at Site 3, we're going to click on the networking tab on the left.
We're going to go down to VPN under network services and we're going to go to
our L2 VPN sessions.
And here's our session from the perspective of Site 3 that's going over to Site WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And here's our session from the perspective of Site 3 that's going over to Site
4.
So here, if we expand the details on Site 3 for our L2 VPN server,
right here, there's an option to download config.
And so the little pop-up help says remote site VPN configuration.
So if we click here on download config, it's going to include that peer
information
that we can just plug in over to the client and be done with our config.
So I'm going to click right here on download config from the server.
And this is warning me that the pre shared key is going to be in this.
And as a result, we might want to keep this file secure and then I'll click on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And as a result, we might want to keep this file secure and then I'll click on
yes.
So here in my browser, I configured my browser to prompt me to specify where I
want to download
files that I download via my browser.
So a lot of times this might just show up in your downloads folder or whatever
your default download location is.
So this is going to download to my downloads folder and the name is going to be
L2 VPN session to site for config.txt.
So I'll save that and then I'm going to go to my downloads folder and open that
.
So here is that file and what we want is the peer code and that is this right WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here is that file and what we want is the peer code and that is this right
here.
So I'm going to go ahead and take everything inside of the quote.
So not including the quote, the opening quote or closing quote, but everything
in between there.
I'm going to right click and copy that to my buffer and then I'm going to go
over to site for and paste that in as the peer code.
So minimize that and let's go back to site for which is still in dark mode.
So this is the NSX manager in dark mode.
We're still configuring the L2 VPN session going back to our server.
And so right here, where it says peer configuration enter peer code, I'm going WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so right here, where it says peer configuration enter peer code, I'm going
to right click and simply paste that content in and then I'll click on safe.
And then if we want to do further configuration, we can click on yes, but I
want to click on no for now.
And now we have this beautiful L2 VPN session configuration here at site for
that goes back to site three to the server.
Also check this out.
If we click here on IP [garbled] sessions, it also in the background created for us
and IP [garbled] session that's going to be used to encrypt and protect the packets
as they go back and forth between site for and the server at site three. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
as they go back and forth between site for and the server at site three.
So here if we go back to L2 VPN sessions and expand this here, I have an alarm.
Let me see what that alarm is and the alarm says the L2 VPN session was down.
That was because we just barely created it.
However, it's been up for a few moments now now showing that the status is
success.
And if we were to click on the IP [garbled] session information, click here on view
statistics because it's a route based VPN that is set up for us.
Anything going over the logical network is going to be encrypted.
Also, just as a verification, let's go to our network topology. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Also, just as a verification, let's go to our network topology.
Let's identify which of our two edge nodes is active by double clicking on our
tier zero gateway here.
And this shows that edge to is the active edge note.
And if we click there, it'll confirm for us what the management IP addresses
and I suggest just for a moment that we open up an S to say session over to dot
67 to this active edge node, which is edge to just to take a look and confirm a
few details together,
including the fact that it has a virtual tunnel interface and we can also WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
including the fact that it has a virtual tunnel interface and we can also
identify what that virtual tunnel interface address is.
So here we are connected via SSH over to edge to at lab four and let's do a get
gateways and let's go to the VRF for services router, which is VRF one.
So we'll type in VRF space one press enter and let's type in get interfaces.
So let me scroll up to the top of that output right here.
So here's the command get interfaces and those right here.
We have a VTI virtual tunnel interface and the address is 172 16 99 dot 17. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We have a VTI virtual tunnel interface and the address is 172 16 99 dot 17.
So it was automatically assigned an IP address from that subnet.
So we use the subnet of once into 16 99 dot 16 with the slash 28 bit mask.
We use dot 30 over at the server and I use dot 17 the first valid IP address on
that subnet for the address on this end of the tunnel.
So we should right here be able to ping the other side of the tunnel, which is
once a two 16 99 dot 30 and that's over at the server.
So let's verify that as well.
So we'll do a ping over to once a two dot 16 dot 99 dot 30 press enter and sure WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll do a ping over to once a two dot 16 dot 99 dot 30 press enter and sure
enough that is working like a champ.
Also, if we exit that VRF and let's do a get IP sec VPN and a space question
mark and let's type in session and press enter.
So there's our current IP [garbled] session that it built for us to protect later to
VPN traffic.
So here we have the endpoints for the tunnel.
So anything that crosses over our tunnel interface, which is using that 172 dot
16 dot 99, etc.
address space, that's going to be encrypted.
We can also get details on the layer to information with a get l two VPN space WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can also get details on the layer to information with a get l two VPN space
question mark and let's go ahead and type in sessions and a space in the
question mark and let's go ahead and look at stats as well while we're there
and press enter.
Another showing us the statistics regarding the l two VPN and currently we have
absolutely no packets in or out and that's because we're not sending traffic
over that l two VPN yet.
So if we're to use a pipe symbol after that and say find and then include the
word packets, then it just shows output that include that literal string of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
word packets, then it just shows output that include that literal string of
text with capital P a C K E T S.
So if we come back into this after we've implemented a common network segment
and associate with the later to VPN, we should see the packet counts in and out
increasing, which leads us to the next piece of the puzzle and that is to go
ahead and create
a common segment at both locations and associate that with the l two VPNs.
So currently we have a few segments that are currently in place, but let's
create a brand new segment at site three where the server is and also here at WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
create a brand new segment at site three where the server is and also here at
site four where this client is.
And then we'll go ahead and take the segments and associate those with the l
two VPN to create one large layer to broadcast domain and associate subnet that
we can then connect VMS to.
So we'll proceed with the creation of those two segments and linking them to
the layer to VPN in the next video.
So I'll see you there in just a moment.
[BLANK_AUDIO]