So let's do a quick recap of our topology.
We currently have three gateways set up
as part of our NSX,
two tier ones and one tier zero.
And those three logical gateways exist
as distributed routers on each of our transport nodes.
So any one of these devices
could make logical routing decisions for traffic going,
for example, from VM-1 here or to VM-4 here.
And also, let me let you in on a little secret.
Up to this point, I've been specifically focusing
on the distributed router function
for these virtual routers, for these gateways. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for these virtual routers, for these gateways.
So with routing, whatever device sees the traffic first.
For example, if it's traffic coming in from VM-1,
it's gonna be ESXI host A,
acting as a host transport node
with a full compliment of the distributed routers
who's gonna make all the routing decisions
and then finally forward it off if it needs to,
to another host or another transport node
over the Geneve tunnel.
And everything we've been demonstrating up to this point
has been been using our Geneve tunnel
between the host transport node A
and the host transport node B,
because those two ESXI hosts, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
because those two ESXI hosts,
they have all the routing information.
They're also the only two hosts that are hosting any VMs.
So up to this point, there hasn't been any reason
for traffic to be tunneled up to our edge nodes,
because the distributed router function
on these two hosts where all the VMs exist,
it can be done all logically
here on the respective ESXI host.
And for a routing decision, the transport node
closest to the source of that traffic
is gonna actually make the routing decision,
and then forward it over the tunnel when needed
to another transport node.
And that's all due to the wonderful WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's all due to the wonderful
distributed router function
that's capable and available inside of NSX.
So currently for our distributed router function,
we have T-0, that's gateway zero,
and we have a distributed router
replicated everywhere that needs to be
for gateway A, which is a tier one router.
We also have a distributed router
for gateway B over here on the right.
So let's imagine we now want to add
on top of this distributed routed environment
some additional network services.
For example, maybe we wanna implement
network address translation right here
on our T-0 gateway.
So I'll list NAT, network address translation, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I'll list NAT, network address translation,
as a IP network service we may wanna add,
or we may wanna set up a VPN,
or we may need connectivity to the physical network.
So for example, right here,
maybe this is our physical network is a physical router.
And what we wanna do is provide connectivity
between our NSX logical layer three-routed environment here
and the physical network.
Whenever we do any of those functions,
network address translation, VPN,
or we provide connectivity
between the NSX routed environment and the physical network,
whenever we implement any of those features, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
whenever we implement any of those features,
that's going to also by default in the background,
implement something called an SR,
which is a services router.
And it's only implemented where it's needed.
So if we set up, for example,
basic connectivity from this tier zero gateway
out to the physical network.
So for example, maybe this is network 10 dot 10,
and this is 10 dot 20,
and then here's our interlink segments,
their auto IP addressed.
And then out here on the physical network,
maybe this is 192.168.1.0
with a 24 bit mask, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
with a 24 bit mask,
maybe our default gateways is at dot one.
And what we wanna do is have reachability
and routability between 10.10, 10.20,
and VMs there, as well as the physical network.
And with the correct NAT and routing setup
to points beyond, including the internet.
So when we implement that functionality, that connectivity,
between the logical network here
and the physical network here,
we're gonna immediately see here
on tier zero on this gateway,
an additional logical router called a services router
that's providing that functionality.
Think of the services router as a special purpose function WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Think of the services router as a special purpose function
for things like connectivity to a physical network
or for IP services like NAT or VPN.
And we don't have to go in
and specifically tell this gateway,
hey, please inject or install this services router.
All we do is specify the service that we want to implement,
and in the background,
it implements a services router for us.
And here's the cool thing,
as we implement our connectivity here,
as we add that, I'm gonna show you before and after,
how this services router component
for whatever feature we're gonna implement,
is automatically added. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is automatically added.
So let me clean this up a little bit
and let me just label this real quick again,
as the physical network and also this as a physical router.
And let me also share something really important
about services routers, or SRs for short.
Most of those functions are gonna be implemented
by our edge nodes.
And here's effectively what that means.
In the past with just distributed routing functionality
between these networks here
and these VMs here with the east-west routing,
these two ESXI hosts can make
all the routing decisions they need, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
all the routing decisions they need,
and then forward when needed
to the other host over the tunnel.
So when we're implementing services
that require a services router function to be implemented,
most of the time, virtually all the time,
those are gonna be implemented on our edge nodes.
So for example, here on our host transport nodes,
they can have a full complement of the distributed router.
So they've got three distributed routers,
one for tier zero gateway,
tier one gateway A, and tier one gateway B, no problem.
However, when it comes to the services router
for the function of connectivity to the external network, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for the function of connectivity to the external network,
that services router is only gonna be available
and supported on our edge nodes.
So I'm gonna put this services router function here in red.
So I'm gonna go ahead and call it SR.
And just to be clear over here,
this is a distributed router function,
distributed router function, distributed router function.
And then over here for the access to the physical network,
it's another logical function called the SR,
which we would then have included
or automatically would be included here
as part of our tier zero gateway.
So our edge nodes would also have a copy of that.
I'll put that here in red as our services router. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'll put that here in red as our services router.
I'll put a little arrow there.
However, our host transport nodes,
they would not have or need a instance
of that services router
because they are not actually providing the connectivity
to that outside physical network.
That's only gonna be done
by one of our edge transport nodes.
So one of the questions would be, okay,
so how do we tie all this together?
For example, what if VM-1 here
is trying to go out to the internet?
So the host transport node that VM is running on
is gonna do a lot of the routing decisions.
But how do we then forward it or know when to forward it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But how do we then forward it or know when to forward it
over to the services router function
over on one of our edge devices?
So we can actually do the forwarding of that traffic app
to the physical network and points beyond.
And the answer is, we are gonna use plain old routing.
And let me explain how this works in this overview.
Let's imagine that this router right here, gateway A,
that its interface address right here is A,
and then the interface address here is B.
And then the interface IP address here
on the distributed router for the T-0 router is C.
And then we're also gonna draw this logical WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we're also gonna draw this logical
back plane connection
between the distributed router function
on tier zero, gateway zero, and what will be installed,
the services router function here also on T-0.
So let's say that logical connection there
is this interface has the IP address of D,
and now the services router that has the IP address of E.
We're also gonna have virtual network identifiers
for each of these segments as well.
So down here, let's go ahead for A,
let's go ahead and use a VNI of one.
So I'll put the VNIs here in pink,
even though it's gonna be a longer number. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
even though it's gonna be a longer number.
It's just for reference, I'm gonna call this VNI one
and VNI two and VNI three.
And the services router function here on T--, gateway zero.
That's providing the connectivity
over to the physical network.
So if we follow the logical process here
with our VNI numbers here in pink
and the IP next top addresses here in yellow,
when VM one here wants to go out to the internet,
the compute host here where VM one is running
has the distributed router.
So it knows all about gateway A.
So it'll say, okay, the traffic from a routing perspective,
it's gonna come in here on this interface. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it's gonna come in here on this interface.
And the next top address is gonna be my tier zero DR.
And that gateway address is C.
And then from the logical perspective of routing,
the next top after that from the tier zero DR
is gonna be the tier zero SR.
And that's the logical process or function
that allows connectivity to that physical network.
So effectively from the perspective of ESXI-A,
the next top that we need to reach is E,
which is on segment three, at which point ESXI-A says, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which is on segment three, at which point ESXI-A says,
okay, I need to get to this IP address on segment three
because ESXI-A has that logical router,
tier zero, gateway zero.
It knows exactly what that segment is,
segment three in this case.
And then ESXI-A is gonna say, okay,
for this segment three where the next top is
and the IP address of E, what is the layer two address?
And this layer two address
provided by the SR function
is gonna be on one of our edge nodes, edge one or edge two.
If we're doing active standby and edge one is active
and edge two is standby,
it'd be edge one supporting that address. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it'd be edge one supporting that address.
So then this host transport node would say,
oh, okay, to get to that next hop of E,
I need to forward it over to the,
let's say it's edge one that has that services router,
and supporting that IP address
and the corresponding layer two address.
At that point, ESXI-A would send the traffic
tunneled over to edge one.
Again, that'd be the Geneve tunnel
because ESXI-A had already made the routing decisions
inside the Geneve header, it would indicate,
oh, this is for segment three.
And then edge one would de-encapsulate that.
It would see that the traffic is destined
for this layer two address WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for this layer two address
of this interface here,
which that SR is running on edge one.
So edge one would continue to process the traffic,
and then edge one would make a routing decision.
The egress interface would be here
on this logical services router on our tier zero gateway,
and then it could forward it over to the physical network.
So as a summary, this ESXI host,
which has all the information about the distributed router
for the tier zero and the two tier ones,
it can make all the routing decisions
up to the next hop of the services router,
at which point it does a lookup WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
at which point it does a lookup
and says, okay, for that segment
and that layer three address,
the corresponding layer two address is reachable
over at edge one,
it causes it to forward it to edge one,
who then receives it and continues forwarding.
And that's the logic about how in the world
does NSX know how to or when to forward
to a specific services router for some network service?
In this case, it's access to the physical network.
And the answer is routing tables.
It's the routing tables on these distributed routers,
they're gonna have a next hop
of the services router IP address,
and that's what causes our host transport nodes WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and that's what causes our host transport nodes
to then forward the traffic to the appropriate edge,
who's supporting an SR function,
who can then continue processing the packet and the frame,
make a routing decision
and forward it on to its next hop.
So let me clean that up a little bit
and let's talk about one other concept.
If we do want to take this gateway here, the tier zero,
which currently is just a DR, a distributed router,
and we want to add the functionality of connectivity
to the physical network here
on behalf of our clients and VMs inside of NSX, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on behalf of our clients and VMs inside of NSX,
we need to create a new type of segment.
So up to this point, we've been creating overlay segments,
and what we're gonna do up here,
we are going to create
a new type of segment, VLAN backed segment.
And all the VLAN backed segment says is,
hey, this is a segment, a logical segment in NSX,
but it's gonna refer to, for example,
VLAN 10 or VLAN 20 or VLAN 30 on the physical network.
And that way our services router,
we can go ahead and logically connect it via that segment,
that VLAN backed segment,
to whatever the VLAN is right here on this network segment WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to whatever the VLAN is right here on this network segment
that we want connectivity to.
So in preparation for implementing our connectivity here
and adding the services router component here at tier zero
for access to the physical network,
I propose in the next video we put a very specific plan
together and then you and I together will follow that plan.
So I'll see you in the next video for exactly that.