And so for our discussion
of logical Layer 3 routing in the world of NSX
I think it would be valuable
just take a moment and remind ourselves
of how that works in a physical environment.
So let's imagine that these four segments
represent four Layer 2 broadcast domains,
like four VLANs, on a network.
So let's use VLANs 10, and 20, and 30, and 40,
and let's say in those VLANs,
we're using the IP addressing space
of 10. and we'll just put a V there for the VLAN number,
with a 24 bit mask, so that'd be 10.20, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
with a 24 bit mask, so that'd be 10.20,
this would be 10.30, this would be 10.40,
and over here I'll go ahead and put a 10 there as well,
just to make it really clear.
Then we have devices,
printers, computers, servers, et cetera,
that are sitting on those networks.
And then regarding IP addressing, it's very likely
how these clients got their IP address via DHCP,
which dynamically assigns the IP address
and also the appropriate default gateway.
So, on that network segment,
if the default gateway is .1 on each one,
we can go ahead and draw that in as a node.
So I've got a couple routers here
to support the 10.10.0 network and 10.20.0 network, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to support the 10.10.0 network and 10.20.0 network,
and we can put another one right here.
And this router's gonna be directly connected
to the 10.30 network,
and this router right here is directly connected
to the 10.40 network.
And in a production network,
it's not too likely that each of these
is gonna be separate physical routers
because we have these multi-layer switches
with logical Layer 3 routing built into them.
But this just represents a Layer 3 routing function
that's available to each of these subnets.
Now currently there's just one interface each,
they're not able to actually do routing to other subnets,
so it's also likely we'd have another router here,
and then we'll put some connectivity here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then we'll put some connectivity here,
again, this could be a logical representation
of how our network is set up.
Again, these don't have to be physical external devices,
they could be logical Layer 3 routing functions,
for example, built in as part of a multi-layer switch,
or we could have a firewall
that's providing the Layer 3 routing.
And for these connections here,
it's very common to use, for example, a /30
or, when the topology and the gear allows it, a /31,
to not waste too many IP addresses.
Or if we're using private RFC 1918 address space, as we are,
maybe it doesn't matter too much WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
maybe it doesn't matter too much
because we have tons of IP address space to play with.
So for our topology example here, let's use 100.64.0.0/30,
and then this guy over here could be .1,
and this guy over here could be .2.
And over here let's go ahead and use the subnet
of 100.64.0.4/30, and this guy could use .5,
and this one could use .6.
And over here we'll go ahead and make this subnet
for that last octet, that'd be eight
if we're using a /30 and going contiguously, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if we're using a /30 and going contiguously,
so this would be .9, this would be .10,
and this would be subnet 12,
and then this could be .13, and this could be .14.
So if we have this computer over here,
we'll call this computer A,
that's communicating with this device right here,
we'll call this device D,
that could be a user communicating with the server
or it could be a web or application server
talking to a database, et cetera,
just two different points on the network
that need to communicate with each other
from the 10.10.0 network over here to the 10.40 network.
And to simplify addressing,
let's give this guy the host address at the end of .10, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's give this guy the host address at the end of .10,
and over here we'll give this guy the address of .40.
So over here, this is 10.40.0.40,
over here this is 10.10.0.10.
So each of these devices
has a default gateway on their local segment
that they've been configured for,
and then from a routing perspective,
to make sure all the routers
can actually make correct forwarding decisions
from left to right and from right to left,
which can also be referred to as east-west routing,
that can be provided as long as all these routers
have appropriate routes in their routing table.
So one way of doing that would be static routes
on all these devices or, even better yet, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on all these devices or, even better yet,
a dynamic routing protocol
to let them share with each other reachability information
to update their respective routing tables.
And that way if have host A needs to forward a packet
over to 10.40.0.10, it forwards it to its default gateway.
So the forwarding would happen
on the Layer 2 local segment,
the actual frame at Layer 2
would be forwarded to the Mac address
of the default gateway.
But at Layer 3, the IP address
would have the destination of 10.40.0.40,
at which point this router would look at its routing table,
make a forwarding decision
to what it believed was the appropriate next hop, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to what it believed was the appropriate next hop,
and this router did the same thing,
do a route lookup first,
and then forward it to the correct next Layer 2 address
in the path.
So that way when this router gets it right here,
it does a route lookup, says, oh, I'm directly connected,
and it can look up the Layer 2 address
and forward it to that destination.
And the way that a device connected to an IPv4 network
finds out the layer to address,
if it doesn't already know it,
is that it makes an ARP request.
Think of it like shouting into this network, or this router,
shouting into the network,
says, hey, I don't yet know what the Layer 2 address is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of this host at 10.40.0.40,
I'd really like to know what that is,
if you own that address,
please respond back with an ARP reply.
At which point this router then learns the Layer 2 address
of that locally connected network device,
and it could forward the frame at Layer 2
to the correct Layer 2 Mac address,
while at Layer 3 we still have the destination IP address
of 10.40.0.40.
So that handles the east-west traffic,
the traffic going left to right and right to left,
inside of this topology,
but what about access to networks outside of the scope here?
For example, we may have devices here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
For example, we may have devices here
that need to communicate to some other data center,
or to the internet,
or something that's not just right here in the topology.
And so if this router has a default route that says,
hey, if you don't have a better route in your routing table,
just forward it off to this next hop for your default route,
and then it's that person, or that entity's job
to continue forwarding.
So in that case, if this client here
needed to get out to, for example, 8.8.8.8,
which represents an IP address
that's external to this little topology here,
this router, acting as the default gateway,
would then forward it based on its routing table, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
would then forward it based on its routing table,
and then this router would forward it
based on its routing table, and that would take care
of our north-south traffic.
Or if I wanted to clean up those arrows a little bit,
for the north-south traffic let me draw arrows like this,
and for the east-west traffic let me draw arrows like this.
And if we do that, check it out,
that looks like the router arrows as well.
Now in combination with this,
if we have RFC 1918 addresses, private addresses
we're using down here, like we are,
and we're going out to the public internet, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and we're going out to the public internet,
at some point we're gonna need some network services,
like network address translation,
to swap out our source address
before that traffic goes out on the public internet.
Also, for a lot of clients to get IP addresses,
we might need some services,
like dynamic host configuration protocol,
to dynamically assign addresses.
Those are examples of some of the common IP network services
that we have in our common networks today.
Well, let me put a little dividing line here,
and let's talk about how we could implement
something similar to this, but do it in software,
with the software defined networking
specifically implementing all these routing features WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
specifically implementing all these routing features
inside of NSX.
So to do that,
I'm gonna start off with our external network here,
or at least a cloud to represent an external network,
outside the world of our NSX routing,
and I'll just label this external.
So what we do in NSX is we create a logical gateway,
and this logical gateway
that's connected to our external networks,
it's referred to as a tier-0 gateway,
but you can think of it just like a router
that's connected to the external network.
And just like any good router,
it's gonna need information, and routing information,
in its tables about how to forward packets. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in its tables about how to forward packets.
So maybe we have a default route that says, hey,
if you don't have a more detailed route
in your routing table, go ahead and forward it
to the next hop address
that is leading to this external network.
And at this point, we could take this tier-0 router,
which is connected to the external network,
and we could also just connect it
to our four segments right here.
So, these are four subnets, and in the world of NSX,
we could have those same four subnets
but these Layer 2 broadcast domains
that are supporting each of these subnets,
they could be overlay segments.
Because at the end of the day, an overlay segment,
in the eyes of the clients who are connected to them, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in the eyes of the clients who are connected to them,
is just a logical Layer 2 broadcast domain,
and in association with that,
they're also using a common IP subnet.
So, I'm gonna go ahead
and call this subnet 10, and 20, and 30, and 40,
and we could use the same IP addressing we did over here.
And then this logical gateway function
could provide the inter-VLAN routing right here
or in this case, in NSX, the intersegment routing,
between these various IPv4 subnets
and also provide connectivity to the outside world.
So once again, we have north-south routing WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So once again, we have north-south routing
from clients going into and out of
this NSX routing environment,
and we also have the east-west,
for client A for example, over here,
trying to communicate with device D over here
on the other subnet, the 10.40.0 network.
However, for scalability, it's often common
to add yet another level of logical Layer 3 routers,
for example, very similar to what we have over here.
And in the world of NSX, this next level right here,
representing these orange routers,
those are referred to as tier-1 routers.
So we'll call this one tier-1 gateway-A, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll call this one tier-1 gateway-A,
and because we have two of 'em,
I'll call this one tier-1 gateway-B.
And again, we could put in four here, like I have here,
but I'm running out of space.
So I'm gonna go ahead and consolidate just a little bit,
simply by using two routers at the tier-1 level
instead of four as we have here.
And so, if we have four segments,
what we could do is put a couple here, and a couple here,
and we're good to go.
So there's our four network segments,
so this could be segment 10, segment 20,
segment 30, segment 40.
We still have client A over here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We still have client A over here,
we still have client D over here,
and we're still using the same IP addressing space
we had in our original topology.
So for the east-west traffic,
that can all be routed this way.
So, for example, this client at 10.10.0.10
needs to communicate with this device over here
at 10.40.0.40.
This client would say,
oh, that destination is not on my local subnet,
it would forward it to its default gateway,
the router would make a routing decision.
In this topology, as shown,
that traffic would be routed to the tier-0 gateway
who would then make your routing decision down here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
who would then make your routing decision down here,
who would then deliver it down here.
So the routing decisions are made first,
and then once they've sorted out the Layer 3 routing,
what they believe is the next best hop,
they'll go ahead and resolve the Layer 2 address
for that next hop, and then forward that traffic
to the next hop.
Or if a client, like client A, needed access to the internet
or some resource outside of our local NSX environment here,
the client would forward, once again,
to their default gateway.
The default gateway, based on its routing table,
would forward it to the next logical hop.
And then in this case, our tier-0 router
would forward that packet to the next appropriate hop WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
would forward that packet to the next appropriate hop
based on it's routing table,
and then that packet would be sent
on, and on, and on through the internet,
or wherever that packet was destined to go
based on the routing tables on those routers.
So that'd be an example of the north-south routing
in this topology.