So to actually take advantage and use the layer 2vpn's, we need to make sure we
have segments
at each of the sites and associate those segments with that ltvpn. So here's
what I propose we do.
At the site where the server is, let's create a brand new overlay segment and
let's go ahead and
call it s3 for site 3 ltvpn segment 99 and then over here at site 4, let's
create a segment called
s4 for site 4 and let's also name that l2vpn and s3 99. And then when we have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
s4 for site 4 and let's also name that l2vpn and s3 99. And then when we have
those segments
created, we're then going to associate them with our layer 2vpn. And when we do
that, that's the
magic that logically creates one giant layer 2 broadcast domain. And then this
traffic goes back
and forth between clients on those respective segments, that traffic is sent
via ipsec between
the endpoints. And let's also take a moment and identify the flow of traffic
between those vm. So
over here on the left, so over here, let me go ahead and just for the purpose WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
over here on the left, so over here, let me go ahead and just for the purpose
of this exercise,
let's call this site 3vm for right there. And for this one, we'll call it site
4vm right there.
And so if we are going to predict the traffic flow between this vm at site 3
and this vm at site 4,
once all the configuration is done, let's start over here with site 3vm. So the
initial processing
is going to be done by whatever host that VM is on. And then that traffic is
going to be sent
to a local edge node. And all of this up to this point would be at site 3. And WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to a local edge node. And all of this up to this point would be at site 3. And
then one of our
edge nodes at site 3 would be sending the traffic over to another edge over
here at site 4. So over
here at site 4, we'd have one of the active local edges here. Let me also label
this as site 4. And
the local edge would do some processing and then hand it off to the appropriate
host over at site 4,
who would then deliver it to the VM. And right here between these two edge
nodes,
the edge over here at site 3 and the edge at site 4, this would be an IPsec
tunnel that's
protecting the traffic. So from anybody eavesdropping on the traffic here on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
protecting the traffic. So from anybody eavesdropping on the traffic here on
the internet or on this
public segment, all they would see is traffic that's being sent to receive
between these two
addresses, the two ends of the tunnel. And as far as the payload is concerned,
no matter what
traffic was being sent back and forth between these VMs, that traffic would all
just look like
ESP traffic encapsulated and encrypted traffic, the courtesy of IPsec to
protect the contents of
what's really happening in those packets. So with that in mind, let's create
our new segments here
at site 3 and at site 4. We'll associate each of them with the layer 2 VPN. We WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
at site 3 and at site 4. We'll associate each of them with the layer 2 VPN. We
'll put a couple of VMs
on there and then verify that it's working. So let's begin here at site 3. We
'll go to the
networking tab. And currently, I have an overlay segment here at site 3 called
site 3 subnet 33.
And what we're going to do is simply create a new one. So we'll click here on
add segment.
Based on our plan, let's call this S3 L2 VPN space SEG 99. And then we'll
connect that to our
tier 0 gateway. We could also just as well connect that to a tier 1 gateway. If
we had one in our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
topology, then we'll select an overlay transport zone. So we'll go ahead and
choose our red overlay
transport zone. Let me go ahead and also collapse the left hand side to give us
a little bit more
room right here. And then let's also specify a default gateway address that
clients on that
network can use. Let's go and use 10 dot 99 dot 0 dot 1 with a 24 bit mask,
just like that. Also,
while we're here, let's enable DHCP services. We'll click here on set DHCP. And
let's go ahead
and use a gateway based DHCP server. And we already have a DHCP profile WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and use a gateway based DHCP server. And we already have a DHCP profile
associated with our
gateway. So it's going to use that DHCP profile. And then for the range, let's
go ahead and put
in 10 dot 99 dot 0 dot 31 all the way through 10 dot 99 dot 0 dot 39. Now I
know that's not very
many. However, I want to be able to confirm when we get a nice address on a
client where it came
from. So we could on each of our sites have local DHCP services, or we can just
have one
global set of DHCP services that we're using from one of our sites. So in this
case, I'm
configuring this pool of addresses right here at the server at site three. And WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
configuring this pool of addresses right here at the server at site three. And
I'm going to set a
pretty low lease time of like say 1000 seconds. And also a DNS server of eight
dot eight to date
to date. And we'll click on apply. All right, so now DHCP services are set up.
Now what's not yet
done is this part right here layer two VPN. So right here we can also just
associate this segment
with that layer two VPN service. But I want to create the two segments first,
and then I'll come back and I'll walk you through linking it up. So we'll go
ahead and simply click WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ahead and simply click
on save and click on now. So there is our segment right there. And let's create
a similar segment
over at site four. So over here at site four, we'll go to networking on the
left. We'll click on
segments here is our current segments. And let's create a new one here as well
over at site four.
So we'll click on add segment. Let's give it the name of S four for site four l
tvpn
segment 99. So the actual name of the segment at each of the sites doesn't
really matter too much
is the linking that segment over to the ltvpn service that does the magic of gl WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is the linking that segment over to the ltvpn service that does the magic of gl
uing it all together.
So here at site four for this new segment, we'll associate it with our T zero
gateway.
We'll also associate it with our transport zone here at site four. And I'm also
going to use the
same default gateway address of 10 dot 99 dot zero dot one with a 24 bit mask.
And let's also set
up DHCP services here for the segment over at site four. So I'll click here, I
set DHCP config.
And we'll set it up as a gateway DHCP server. And for the range here, let's use
10 dot 99 dot zero WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
10 dot 99 dot zero
dot. And let's use 41 through 10 dot 99 dot zero dot 49. And that way we can
see exactly who got
what IP addresses and from where so at site three, I'm handing out 31 through
39. And here at site
four, we're handing out 41 through 49. Or we could just leave off DHCP services
here. And once we
have the layer two VPNs all set up, a client at site four could get an IP
address from the DHCP
service over at site three, because at the end of the day, they'll look and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
service over at site three, because at the end of the day, they'll look and
feel like they're on one
logical layer two broadcast domain. And so DHCP services at site three would
support the clients
over at site four. So here, I'm also going to set it fairly low lease and I say
1000 seconds.
And for DNS, I'll point out to Google DNS server, just like that. And we'll
click on apply. Also,
once again, here, we could go to the L2 VPN settings and identify the L2 VPN
that we want to join. But
before we do that, this will verify basic connectivity. So we'll click on save
and click on no. And now
that we have these two new segments, one here at site four, and the other one WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we have these two new segments, one here at site four, and the other one
over at site three,
I would like to put a couple VMs on those segments and just verify that locally
, they can get out
to the internet. Now at site three, I already have not set up and there's
external access.
And at site four, else I've not set up an external access. So it's what I
verify with these two VMs
before we include both of them as part of our layer two VPN. That's what I
verify we have basic
functionality at both sites. So to do that at site three, let's go to the v
Sphere client and put WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Sphere client and put
this VM on the segment and verify that we can get out to the internet. So here
in light mode,
on the vSphere client at site three, let's go to the networking tab. And let's
currently see
what we have out there. So on site three subnet 33, I've got a couple VMs. Let
's go ahead and use
this site three red VM. I'm going to right click on the NSX segment here and
say let's migrate VMs
to another network. And let's target the new one we just made, which is our
site three L2 VPN WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
site three L2 VPN
segment 99. Click on next. And let's just move this one specific VM over there,
site three red VM
right there and click on next and finish fantastic. So it should disappear from
this list. And when it
does fantastic, we'll go over to segment L2 VPN, seg 99. And we'll confirm our
VM is there. Sure
enough. So we'll go ahead and click on our VM. We'll power it on by clicking on
the icon for power on.
And let's also open up a remote console to the site three red VM by clicking WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's also open up a remote console to the site three red VM by clicking
right here. So here
is the window for that little teeny VM. Let me make that a little bit bigger.
Fantastic. And
let's do an IF config for ethernet zero just to confirm its IP address. So it
got the IP address
ending in 31. Let's also confirm it has a default gateway with the route space
dash N. And it has
a default gateway of 1099 01. And as I mentioned, I already have not set up out
to the public internet.
So let's do a trace. I'll do a dash N for don't bother doing name resolution. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's do a trace. I'll do a dash N for don't bother doing name resolution.
And we'll do a dash M
six for the maximum number of hops to be six just to verify the initial several
hops out
towards the internet. And let's also verify name resolution at the same time by
trying to go to
www.vmware.com and press enter. And sure enough, that looks great. So it's
going out to the internet.
DNS is working fantastic. Let's also do the same verification over at site for
so over at site for
which is in dark mode, we'll go ahead and make sure we have a VM on that
correct segment. And
then verify we can get up to the internet from that one as well. All right. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
then verify we can get up to the internet from that one as well. All right. So
here we are in the
vSphere client at site for let's go to the networking tab. And I've got site
for segment 44. And let's
go ahead and use this little VM right here site for violet VM. So I'm going to
right click on that
network segment from the drop down, say migrate VMS to another segment. And the
target is going to be
our S for L to VPN segment 99. We'll click on next. And then we'll choose just
that one VM site for
violet VM. And then click on next a couple times and finish. And that should WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
violet VM. And then click on next a couple times and finish. And that should
disappear from this
list. There it goes. And now if we go over to that new segment, there it is
right there. So we'll go
ahead and click on it. We'll power it on. And let's open up a remote console to
that one as well.
So here is that VM. Let me go ahead and make that a little bit bigger for us.
And let's do an
IF config. So we've got an IP address from its local DHCP services on the local
segment. And
let's also verify that it has a default gateway with route space dash and press WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's also verify that it has a default gateway with route space dash and press
enter. So it's
default gateways 1099 01 here at site four. And let's do a trace route with no
name resolution needed.
And a maximum number of hops, let's say seven out to www.vmware.com. And that
'll verify name
resolution. It'll verify internet connectivity. And also based on a second hop,
it's going out
through our service provider at 24 dot 1 dot 2 dot 1. So now that we've
verified that these two
VMs can get up to the internet, let's now merge effectively these two segments. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
VMs can get up to the internet, let's now merge effectively these two segments.
This one here at
site three along with this one site four. And to do that, we're simply going to
associate
those local segments with the LTVPN. Now, as part of that, they're going to ask
us for a segment number.
Let's just use a segment number of 99. And then once we associate this segment
with our layer
to VPN and this segment with our layer to VPN, effectively, these two segments
appear as one
giant layer to broadcast domains. And these two VMs should be able to reach
each other. And as they
do so, that traffic, as it goes between the edges at the respective sites, will WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
do so, that traffic, as it goes between the edges at the respective sites, will
be encrypted and
protected via IPsec. Also in preparation for this, let's just verify that they
can't currently
ping each other. So from the left VM, that's the site three red VM, let's do a
ping over to 10 dot
99 dot 0 dot 41, which is the IP address over at site four. And then from site
four VM, let's go
into a ping to 10 dot 99 dot 0 dot 31, which is the IP address of the site
three VM. So at the moment, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
three VM. So at the moment,
none of that traffic should be making it because we don't have those two
segments where those two
VMs are those are not currently associated with the layer to VPN. But once we
make that association,
then that traffic should be forwarded between site three and site four
respectively.
So here at the NSX manager for site three, we're going to click on networking.
And there's actually
two different ways of linking a segment with an L2 VPN. And I'm going to
demonstrate both for you.
So here at site three, the first option we have is we could actually go down to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here at site three, the first option we have is we could actually go down to
the network
segment. So we'll click on networking, we'll go to segments. And then we'll
find the segment that
we want to associate with the layer to VPN, which in our case, at site three,
it's this one right
here, the S3 L2 VPN, SEG 99 segment. And what we'll simply do is we'll simply
edit it by clicking on
the three dots, clicking on edit, and then scrolling down, and then expanding
the L2 VPN section for
that segment. And from here, we just associate it with our layer to VPN. So to
do that, we'll click
here in this box is showing us a dropdown of all the L2 VPN services available. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here in this box is showing us a dropdown of all the L2 VPN services available.
So we have the
site three L2 VPN servers, we'll select that next is asking us for a tunnel ID
that can be between
one and 4096. So let's use a tunnel ID of 99. And then we also have an option
of setting up a
local egress gateway IP. So because we already have one at each of the sites,
we don't also need
to include one here. So all we've really done is specify the layer to VPN, and
a VPN tunnel ID
for that segment. And we'll click on save, and then we'll scroll down and click
on close editing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on close editing.
And so now if we went back to our network services and to VPN, and we went to
our L2 VPN sessions,
check it out here for this L2 VPN session that we have between site three and
site four,
it now shows that there's one segment associated with that L2 VPN session. If
we click on that
hyperlink there for that one is showing us the exact L2 VPN segment, including
the VPN tunnel
ID associated with it. So here at site three, we've associated our segment,
which is right here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which is right here,
we've associated it with our L2 VPN. So now all we need to do is do the similar
treatment over
at site four. So here at site four, we'll click on networking. And once again,
we could go to our
segments and then go edit the details for this segment right here and associate
with our layer
to VPN, or we could go to our VPN section here under network services. And then
we could click on
our L2 VPN sessions right here. So currently for this L2 VPN session, we have
zero segments
associated, but we could click on the three dots, click on edit to edit our L2 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
associated, but we could click on the three dots, click on edit to edit our L2
VPN session. And then
here for the segments, we could click on set, which once again gives the
opportunity to associate
the segment that we want to include as part of the L2 VPN. So here at site four
, we'll click on add
segment from the dropdown, we'll choose the correct segment, which is this one
right here,
S four L2 VPN, S. 99. We'll specify the tunnel ID of 99. Once again, we have
the option of setting
up a local egress for outbound gateway IP address to use. We already have that
set up as part of the
segment. So I'm going to go ahead and click on save and click on close. And WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
segment. So I'm going to go ahead and click on save and click on close. And
then we'll click on
close editing. And notice now that we have a one here representing that we have
a segment
associated with our layer to VPN, we can also crash reference and confirm that
by going to segments,
expanding our S four L2 VPN, S. 99, expand the L2 section right here. And it's
going to have those
same details right here, because we can figure those at the segment.