So now we are going to talk about LISP and VXLAN from the perspective of next-gen networking.
Let me ask you first, is anybody using LISP at all or VXLAN at all?
If you are, type in yes. If you're typing no. If you don't know, even know what I'm talking about, type in question marks.
I'd like to get an idea of how many people even know what we're talking about.
So let me set the stage for you first and foremost.
There is a new form of networking that exists called Software Defined Access, SDAccess.
Software Defined Networking, but Cisco, for their enterprise environment, calls it Software Defined Access.
When you deploy SDAccess in the world of Cisco, there are two protocols that you need to be very familiar with.
They are the two protocols that make the magic happen.
LISP and VXLAN.
However, none of these protocols were invented originally for the purpose of SDAccess.
Let's be clear about that.
LISP was invented for something totally different, and we decided to just use it for SDAccess.
VXLAN was invented for what? Data centers.
Data centers to solve VLAN problems in the data center, and so they came up with VXLAN for the data centers.
But see, now we can use both of these in our enterprise campus networks with SDAccess.
And so I'm going to teach you about LISP and VXLAN here, and then in our next discussion, we'll talk about SDAccess.
So if you struggle with the concept of SDAccess, more than likely it has to do with your struggling of the concept of LISP and VXLAN.
So make sure that you know LISP, VXLAN, and SDAccess.
Together as a group, that'll make you understand them best, and that's what I'm going to do here today.
I'm going to teach it to you from that perspective.
You'll learn about LISP, but I'm going to focus on enterprise implementation of LISP.
So we're going to constantly go back to our enterprise campus and diagram and diagram and diagram here today.
Now, your goal for the exam is what? Understand what LISP is.
Pick terms and definitions out of a lineup for LISP.
Same thing with VXLAN.
So your goal is to know the terms and definitions for LISP and VXLAN and have a high-level understanding of what it is,
why we use it, why we care about it today, and why many of you may not use it going forward.
Okay, that won't be on the exam, but you'll say, like, I'm really just learning this for the exam.
Yeah, you are.
But you never know.
Five years from now, you might be in an environment that needs it.
So at least you've got the certification to say, hi, I learned it at some point, well, part of it anyways.
And then SDAccess, same idea.
A lot of you will go like, wow, this is crazy, just like with TrustSec.
But, you see, TrustSec and SDAccess go together.
So TrustSec, SDAccess, LISP, VXLAN, they're all part of this new paradigm of networking.
So, first of all, what is LISP?
Okay, so LISP is a protocol that stands for Location Slash ID Separation Protocol.
Think about its name for just a second.
Location Slash ID Separation Protocol.
What do you think this protocol is about?
Separating locations from identifications.
Okay, what does that mean?
You're going to learn about that momentarily.
But why was it invented?
It was invented to create.
It was invented because of scalability and addressing problems on the Internet.
That's right.
It was to solve Internet-related problems, problems related to scalability and addressing.
What were the problems of scalability and addressing?
Well, location and ID.
If you are here on the Internet, that is your location and you have an ID.
If you go somewhere else, you can't take any of that with you,
which really required us to design an Internet that was very location-based.
And so, if you're here, there's your location, there's your ID.
But if you go somewhere else, you can't take that with you.
LISP solves that problem for us.
So, LISP is both a routing architecture itself, as well as a data and control plane protocol.
And so, LISP gave us the ability to solve the problems of the Internet
that had, like, aggregation problems, traffic engineering problems,
multi-homing problems, instability problems, mobility problems.
That's why LISP was invented.
Okay, you don't need to know that for the exam, but that's why it was invented.
But now, we use it where?
In our data centers, in our campus networks, in our branch offices,
in our next-gen wide-area networking solutions, in our service provider cores.
Why are we talking about it here today?
Because LISP is part of SD Access.
LISP is part of our campus networks.
LISP is part of this growing movement of next-gen networking
with better security and zero-trust architectures.
So, as I mentioned a little earlier, LISP is what?
Location and ID separation.
So, think about your traditional architecture.
Your traditional architecture, whether it's on the Internet or in your campus environment,
if you are here, this is your location, this is your ID.
And no matter what, that ID is only available in that location.
If you go somewhere else, your identification changes.
So, think about it here.
If you're here, this is you.
That's your location.
VLAN 10, let's say.
This is your subnet.
And you are 10.0.0.5.
So, your location and your ID are tied together.
You are identified by your network and your IP address.
Tightly coupled together.
But if you move here,
Oops.
If you move here, and that's where you go,
you unplug and you plug back in, or you connect to a wireless access point down there.
Now you are in, what?
Let's say VLAN 50.
10.0.50.0.24.
And you are 10.0.50.24.
Let's put 20 instead, because I don't want it to look like the subnet mask.
So, now your location has changed.
Your ID has also changed.
So, what else, folks, do you think probably changed as well?
Something we talked about in our last session.
Not session, video, conversation.
Your security posture, right?
Your security policies have changed as well, possibly.
So, this is not good.
It's impossible nowadays to invoke end-to-end security in policies
and this type of mindset and this type of architecture.
But see, with Lisp now, if we use Lisp in our environment, what can I do?
I can separate where you are from who you are.
So, right now, you might be 10.0.0.5 in this location.
But if you move here, you can still be.
You can still be 10.0.0.5, even though you are not in your location.
What does that mean?
It means your ID follows you where you go.
And so, when you think about TrustSec, right, TrustSec is part of that.
When you log in with your username and password and your contextual ID,
the device, et cetera, et cetera, is all being authenticated, right?
We don't care about your, like, IP address and things like that.
We can, but, like, we don't care necessarily about that.
We don't even care where you are when it comes to your security policies.
But from the concept right now of Lisp, I can separate out who you are from where you are.
So, that way, you can always be the same thing
and always have the same policies applied to you no matter where you are.
Can anybody name one other network that you know about that already does it this way,
that you use every single day?
That's right.
There's another network out there that does it this way that you use every single day.
And we don't even realize it's doing this.
Cellular network, folks.
Cell phones.
This one's totally coming in handy, and I'm telling you,
if you have cell phones every day, then that's where you spend
all of your stuff.
Like, what do you do every day, man?
That's the best thing.
Who knows?
What are you doing every day?
Cell phones.
Who knows?
Cell phones.
When on a fast break,
cell phones.
Think about it this way.
Right now, you have your phone,
and let's say you are in your hometown.
Right now, you have a phone number with an area code in your hometown.
Your location and your ID are tied together right now.
But if you travel to Vegas right now,
unless you're living in Vegas, sorry,
then you don't qualify for this scenario,
but if you travel from where you are right now and you go to Vegas,
does your phone number change, folks, yes or no?
Nope.
Does your location change?
Yep.
So what has to happen?
You leave where you are, and when you leave,
do the cell towers know that you are leaving?
Do the cell towers know you?
Yes.
And every time you connect to a different cell tower,
the cell tower has to tell the centralized server that.
So that way if somebody tries to call you,
the centralized server can route to the right cell tower,
that will get to you.
And then as you continue to move,
let's say you're even on the phone,
could you register with another cell tower as you keep going along?
And that tower tells the server, yeah, of course.
Let's say you hopped on a plane.
You're in the air.
You're not connected to anything.
You land.
You connect to a cell tower.
That cell tower tells the central server, hey,
this phone number is now registered to me.
The server updates itself.
You are now in a different location, but you are the same ID.
And the network adjusts to get to you.
Same idea.
So what does that mean?
It means when you connect to the network here,
this switch has to notify a centralized device that you are connected there.
And if you move,
then this switch has to tell that centralized device that you are now there.
And that centralized device keeps a database of where everyone is in the
environment.
And even if I go home and I plug in at home or I plug in a remote office,
same thing is true.
Raymond's now over there,
connected over there with that particular device,
I can apply my trust tech policies and everything else that go along that as well.
That is a very flexible, scalable network.
All right.
But that requires a little bit of architectural changing to make it work, folks.
It really does.
So look at our layer two, layer three boundary right now.
Although we could implement LISP as such, we typically don't.
It's a less practice way to do it to ensure that you get the greatest enforcement,
the greatest coverage,
the greatest routing,
the greatest everything.
When it all comes down,
you gotta move that boundary line.
You wanna move that boundary line down to here.
You wanna move that boundary line here.
You wanna move it here.
For example,
you wanna get it as far down as you can.
Well there was no layer two there anyway so it was all layer three down there.
Okay.
But you gotta move that boundary line.
You gotta get it down,
down,
down all the way down.
Okay.
So we moved that boundary line down.
But also,
now what we do is we create what is called a fabric.
And that fabric is an environment that we can virtualize networks on top of this.
Right.
So this relies on a lot of virtualization to make it all work.
So when you look at this,
we've now moved our boundary lines down.
And we've implemented multi-layer switches instead of just pure layer two switches.
There are now multi-layer switches down there.
And our fabric,
because this is gonna be SD access as I was talking about,
all right,
we are talking about just the enterprise right now,
not our data center.
So our data center is still gonna be the ACI,
the applications centric infrastructure.
It's called ACI,
application centric infrastructure.
But for our enterprise network,
it's got a nice little fancy name called SD access instead.
So you can see there's a little bit of a shift here now in what's going on.
But it's important that we have our layer two,
layer three boundary here instead.
So does that mean everybody is essentially directly connected to their default gateway?
Yeah,
pretty much.
And this causes a lot of confusion because people are like,
well,
then wait,
wait,
how does this work?
How do I implement a VLAN that spans multiple then multi-layer switches?
I can't do that anymore.
Can I?
Well,
that's where something like VXLAN comes into play.
That's where VXLAN comes into play.
VXLAN is gonna allow me to interconnect devices together that are part of the same subnet,
but are not actually connected to the same device.
So does that even mean that I could have somebody here in VLAN 10 as an example,
and now somebody here in VLAN 10?
Sure,
absolutely.
I mean,
in the same subnet too,
Raymond?
Yeah.
What about the same broadcast?
I mean,
yeah.
Wait,
how does broadcast traffic get across there?
Because with VXLAN,
which we'll talk about later,
that's how we tunnel that traffic through.
But we can't have VXLAN running until LISP.
Until LISP builds the network that VXLAN can run on.
So that's what the two protocols are for.
We have LISP to build the network,
VXLAN to route the traffic.
More on that later.
Now,
does LISP need,
can LISP operate all by itself?
The answer to that is no.
What must be running in this network,
folks,
before you can even implement LISP?
Take a wild guess.
Yes,
some type of dynamic routing protocol.
Some type of IGP.
OSPF,
EIGRP,
ISIS,
those are all possible options.
So you have to have full connectivity
from a Layer 3 standpoint
from here
to here
to here as an example in this case.
So we're going to be running OSPF or EIGRP or ISIS.
And actually,
the recommendation is ISIS,
by the way,
folks.
That is actually the recommendation.
So I'm pretty sure eventually down the road,
Encore and in RC,
we're going to start covering ISIS in those courses
because if they're introducing SD-AXIS now,
I'm pretty sure we're going to start learning about ISIS
for the enterprise now.
But you can use OSPF,
you can use the EIGRP,
but ISIS works better.
It does because ISIS is a more open,
flexible protocol,
and it works really well with SD-AXIS.
So full connectivity.
Why?
Because we want to be able to make sure we can route from here
to here or from here to here or from here to here
or from here to here or from here to here
or from here to here or from here and so on and so forth.
So we have to make sure we can route to all,
between all those different devices with our underlying protocol,
our underlying protocol.
All right.
So let's talk about some LISP terminology.
Now we need to get ready for the certification exam.
So, for example,
we have LISP sites.
That's number one.
What is a LISP site?
So a LISP site is where any type of LISP routers
and endpoints reside.
A LISP site is where any LISP routers
and LISP endpoints reside.
So when you look at this scenario here,
this is typically how you see LISP represented
because LISP was designed, what,
for the Internet originally.
So a LISP site might be somebody's autonomous system.
A LISP site might be another autonomous system.
And when you think about it from the Internet standpoint,
and then at this LISP site,
we have a LISP router that connects us up to LISP.
And so this LISP router is going to have the ability
to do the LISP-related stuff we need,
like that LISP router will for that LISP site.
So a LISP site is where we have routers and endpoints.
But when you look at it from the SD access standpoint,
you are actually going to define your LISP site.
So, for example, this might be a site.
Notice my entire environment is not the site.
See, the site is essentially the location.
Think of it that way.
The site is essentially the location.
So I could have another LISP site here,
and that could be like that.
We could have a LISP site here.
We could have a site here.
And inside that site, yes, will you have your VLAN?
Yes.
Will you have your subnet?
Yes.
Do you have your broad?
Yes.
All right?
Yes.
So inside of that site, we are going to have what?
We're going to have a LISP-speaking router.
So here is my LISP-speaking router right here.
It's my multilayer switch.
In this case, I have two of them here.
This one has one here.
This one has two here.
Those are the LISP-speaking routers.
And then you have all your end users in there,
connected to the switch ports on those multilayer switches,
on layer two interfaces.
And so would we have our SVI set up right here instead of here now?
Yes.
So think about it.
These are all routed ports.
Routed ports.
Whereas now the SVI is on here,
and anybody in access port VLAN 10, VLAN 10, VLAN 10.
So no more trunks, right?
There's no trunk links now.
They're essentially gone.
I have access ports going down to my end users
unless I need a trunk that goes down to a server, right?
Maybe.
Maybe I need that.
But in the end,
I have essentially access ports going to the users,
and then I have my default gateway as the SVI
that you're directly connected to.
No spanning tree protocol.
I love it.
No first software density protocols.
I love it.
A lot less things I now have to implement.
But now I've got to learn how to do LISP and VXLAN
to make all this work.
I've got to learn about these things called LISP sites.
So you've got your sites.
But then what do you have?
You've got your endpoints.
So these are two terms I want you to know.
You've got your endpoints,
the IP assigned to the actual endpoints.
So you have a PC.
Your PC is your endpoint.
Your phone is your endpoint.
Your printer is your endpoint.
They get an endpoint identifier,
which is the IP address assigned to them
in that particular site.
So let's present this as site 10.0.20.0.24.
Then this device will get 10.0.20.0.24 as an example.
We go over here.
We've got 10.0.10.0.24.
So you're getting 10.0.10.0.24.
So you get an IP address in your subnet.
But I want you to notice here
that there's something called an RLOC.
An RLOC, a routing locator.
This is the IP address assigned to the device
that is making up the routing system.
This is the IP address assigned to your LISP router.
So your LISP router needs a very special IP address
given to it to identify itself on the LISP network.
And yes, this is something I want to be able
to route to and from.
So this is not like your OSPF router ID.
But this could be a loopback interface, as an example,
with an IP address on it.
And that is identified as my RLOC,
my identifier in my LISP environment.
So if we go back here.
Not there.
If we go back here,
this would have to have an RLOC.
So let's say I gave it an RLOC of 192.168.1.1.
And I gave this one an RLOC of 192.168.1.1.
And I gave this one an RLOC of 192.168.1.1.1.
And let's say it was slash 32, the IP address.
And let's do 192.168.1.2.
So all of these devices here need RLOCs.
This does not need an RLOC.
This does not.
Why?
Because they are not part of sites.
They are part of the underlying routing infrastructure
that gets you from site to site.
So LISP is really only running on those edge devices.
That's really where it's running.
So RLOC, RLOC, RLOC, RLOC, RLOC, RLOC, RLOC over there,
and RLOCs right here.
So wherever you see our defining point,
like we said, this is our environment here.
Right now, that's what we're building.
So all the devices on that red line
get an RLOC assigned to them.
Now, here's the cool part.
You ready for this?
You run your dynamic routing protocol
for that IP address.
What does that mean?
It means that, for example,
inject that into OSPF, inject that into EIGRP,
inject that into ISIS.
What does that mean?
Every router now inside of this red box
learns about these addresses.
Now we can route to each other, right?
Now we can route to each other.
But this is even cooler.
You never, ever, ever have to teach
any of these routers in here,
about any of your end-user networks.
Why?
Because none of these routers
will ever be routing to your end-user networks.
They will be routing to your end-user networks
they will be routing to who?
They'll be routing to the RLOCs.
That's right.
They'll be routing to the RLOCs.
Not in some ways.
Erase that.
It means a smaller routing table in here.
Way smaller.
Yes, absolutely.
Way smaller.
Yeah.
Good vision there.
Good vision, you're right.
Way smaller routing tables.
That's incredible, right?
That is, when you think about it.
And this is where people struggle
because they go,
then how do I get there?
I got to teach you that.
We're not there yet.
I'll show you.
All right, so, remember,
that's your endpoint identifier.
Know that.
And there's your RLOC.
But I want you to realize now
that you see the separation?
You have an endpoint identifier
and that is totally different
from where you're located.
So what does that mean now?
If you are 10.0.0.5,
you are 10.0.0.5.
You are 10.0.0.5
currently connected to 192.168.1.1.
You are 10.0.0.5
currently connected to 192.168.1.1.
Think about it, cell phone.
You are currently 5.5.5,
5.5.5, 5.5, 5.5
connected to the Phoenix cell tower.
You then hop in your car,
drive to Vegas.
You are 5.5.5, 5.5.5, 5.5, 5.5
connected to the Vegas cell tower.
Same idea.
This improves scalability
for routing systems, as we've seen.
Improves multi-homing efficiency.
Makes it a lot easier to do your trust sec
and your traffic engineering
and all of that stuff
when it's all said and done.
Now you need to understand
these terms for the exam as well.
You need to understand, first of all,
what an XTR is.
XTR is any router,
LISP router,
LISP router that performs
ITR and ETR functions.
ITR is a LISP router
that encapsulates IP packets
that are leaving the environment.
So if traffic is flowing this way,
I am an ITR.
If traffic's flowing this way,
then I'm an ETR.
ETR says a LISP router
that decapsulates LISP packets
from a site that are destined to that site.
So packets leaving my site,
I'm an ITR.
For packets coming in, I'm an ETR.
We perform ITR functions,
encapsulation functions,
and you perform ETR functions,
decapsulation functions.
So in this case here,
we take a momentary step back.
So this LISP router
is going to be an ITR as traffic leaves
and an ETR as traffic arrives.
An ITR as traffic leaves,
an ETR as traffic arrives.
An ITR as traffic leaves,
an ETR as traffic arrives.
Remember that.
Also, I want you to notice this.
This is critical.
The ETR, the ETR, not the ITR,
the ETR,
they might test you on this,
publishes EID
to RLOC mappings for a site.
So the functionality of the ETR
is to also do what?
It's to learn
who's connected to the router
locally
and then update
the centralized server
that has the database
of information.
So let's talk about that server.
The server could actually be
a physical server, folks,
you have doing this job,
or it could be another router.
A router, you can have Cisco routers
acting as a LISP mapping server.
And so regardless of
whether it's a physical server
or a router,
what is the mapping server all about?
It's about having a database.
And it is going to learn
about all the endpoint identifiers
and their prefixes.
So you are 10.0.0.5
slash whatever, right?
All of that, we learn that.
And what?
Who you're connected to.
So I take, like, say,
this information as an example
and this information
on the ETR.
So I take that
and I send that up to here.
That's what I'm going to go ahead and do.
And then a mapping server
stores all of that information for us.
So if we go back to this page again,
who could that be in this environment?
Well, typically, right,
we could,
not typically,
we could have it as a server over here.
Or we could even set up
this device right here.
That could be a mapping server
if we wanted to.
And therefore,
this device would have the database
of RLOC to user mappings.
RLOC to user mappings.
Now, let me take a moment here
to explain to you that
there's the concept
of what we call the home site.
So, for example,
if this network here,
this entire site,
was 10.0.0.0 size 24,
and you are in your home site,
you are 10.0.0.5
and you are in 10.0.0.24,
then this mapping server
does not have to be updated
about you specifically.
Why?
Because you are in your home site.
So, if everybody's in their home site,
then the mapping server
will really only have
network IDs to RLOC mappings.
That's it.
So, like 10.0.0 size 24 is connected here.
10.0.1.0 size 24 is connected here.
Okay?
But if you move,
like, for example,
if I move from here
all the way down to here,
then I'm in a different site.
Therefore,
this device would then update
the mapping server
and say 10.0.0.5
slash 32,
making it like a host-type route,
is connected to,
let's say this RLOC is 192.168.255.
Or what were we doing?
Ones?
1.3.
You are now connected
to 192.168.1.3.
So, that would be a specific entry.
So, specific entries are only sent
when you're not in your home site.
But if you're in your home site,
but if you're not in your home site,
we'll send that.
So, to wrap that up,
keep that in mind,
that you don't have to worry about
this becoming overwhelmed
unless everybody's not in their home site.
But if the majority of people
are in their home site,
then that's perfectly fine, right?
Because anybody who moves,
it'll be updated for those specific moves,
but the home sites stay where they are.
And so, the home site would be listed,
like I said, as a slash 24,
or whatever the subnet mask is.
And if you're not in your home site,
you're a slash 32,
which means from a routing standpoint,
longest match rule wins.
Longest match rule wins by the mapping server,
just like it would for a routing protocol.
All right, where were we?
We were on the mapping server, right?
Okay, so we're on the mapping server.
So, know that.
Now, the mapping server,
there's another entity, sorry,
called the map resolver.
And the map resolver is the one
who actually does the work.
It resolves the mapping request.
So, for example,
if I am trying to go from here over to here,
how do I know that this device lives there?
Well, that's not up to this person to decide.
That doesn't matter.
They don't need to know that.
They just need to know the IP address
that they're trying to reach.
So, I'm trying to reach 10.0.0.10,
or 10.0.10.10, I should say.
So, my packet, I create a source for me,
destination to there.
So, when the packet arrives at this router,
this router has to figure out,
how do I get to 10.0.10.10?
So, it has to reach out,
not to the mapping server,
no, no, no, to the map resolver.
So, it reaches out to the map resolver
to find out, and it says,
hey, hey, woo-woo, yeah, map resolver.
Look at me.
I'm the ITR over here,
and I want to know,
how in the world do I get to 10.0.10.10?
And so, then the map resolver
contacts the mapping server,
and then that information
can be provided back as an example.
So, what would be provided back is,
this is reachable via this.
So, now I know that if I want to go here,
I got to go to here first.
So, what this does is,
it allows this router to know,
it now has to encapsulate the packet
from here over to here,
and then this router decapsulates it
and sends it to here.
So, essentially, when I'm routing,
I'm not routing from here
all the way over to here.
I'm routing just like we did
with GRE tunnels and IPSec tunnels.
I'm routing from here over to here,
boof, because we're separating, right?
And then if you decide to move somewhere,
if you move, let's say this device
moves over here into a different lift site,
then that mapping server would be updated.
So, when you ask for that information,
then you're going to be pointed that way instead,
so you can build your tunnels that way.
It's all about building tunnels.
So, the mapping server and map resolver
can be two different devices,
or they can be one in the same device, folks.
And typically, for the sake of software-defined access,
they're typically going to be one in the same device.
But in like a really large internet LISP implementation,
they're typically going to be different devices
when it's all said and done,
so the mapping server doesn't get overwhelmed
with requests plus all the updates
that it needs to keep track of.
Yeah, there are a lot of similarities
with SD-WAN and different things like that.
Why? Because when you think about it,
it's all about software-defined networking.
So, taking those concepts
and applying them in those different scenarios,
absolutely.
Are any of these servers the DNA center?
The DNA center, we're going to get to that.
We're going to get to that.
We're getting there.
All right, so with that said now,
let's talk about or look at an example
of what's going on in this particular case.
So, we have to talk about registration now.
So, right now, we're going to go with,
this could be the internet as an example, right?
Or, look, it says you're at the core of your network.
So, if you think of this as a multi-layer switch,
this is a multi-layer switch instead,
and you think of this as like one of your core switches, right?
It's the same thing we were just talking about.
It's the same thing.
We just have routers here instead of multi-layer switches.
And so, this is a multi-layer switch,
and this is our subnet.
This is a multi-layer switch.
This is our subnet with our end users attached to it.
So, now, ETRs, remember,
send the mappings to the mapping server.
So, the ETR sends the mappings to the mapping server.
So, let me diagram this out for you.
What do we have?
We have this ETR saying that 10.0.10.10.32
is connected to this RLOC.
And then this ETR is saying 10.0.20.20.32
is connected to this RLOC.
And then they send them to who?
They send them to the mapping server.
All right, so remember that for the exam.
The ETR, the ETR is the one that updates the mapping server.
Now, remember, if these were all in their home networks,
then we would be seeing things like this instead.
All right, so if they're in their home networks,
this is what we would see.
If you're not in your home networks,
then you're going to get some individual entries that are added,
slash 32s.
So, now we have our mapping server database as an example.
So, we enter the database, or the info in our database,
and the mapping server sends a map notify to the ETR
to confirm that the map register has been received and processed.
Perfect.
All right, now what about forwarding now?
Let's diagram forwarding so you can have a better understanding.
So, in this case, in a LISP environment,
purely LISP environment, right, with underlying,
let's say we're running ISIS underneath all of this,
what's going to happen?
Well, let's say this user wants to talk to this user over here.
So, what does that user do on the left-hand side?
They create a packet.
And what is that packet?
That packet says, I want to go from me, which is 10.0.10.10 to 10.0.20.20.
Now, how would I figure out the destination?
Well, DNS, folks.
That doesn't change, right?
You're still using DNS for name resolution.
Everything else you know still exists here.
And it works, okay?
It works.
So, your user still has an IP address, a subnet, everything,
DNS configuration, default gateway configuration, like you know it.
And if you type in a browser URL or you're browsing network neighborhood
or you type in the name of the PC you want to contact
or the server you want to contact,
DNS is going to resolve the IP address of that.
So, there you go.
We got our information.
None of that changes.
That's still the same.
But here's now, and then we send it out.
And where does it go?
It goes to your default gateway, right?
We have our frame.
We build our frame.
The frame goes to your default gateway.
Okay, now your default gateway has it in this case.
And so, your default gateway is the LISP router in our SD access environment.
It's the default gateway, the LISP router in the SD access environment.
So, now this router has to say, how in the world do I get here?
How in the world do I get here?
Because it doesn't know how to get there.
Remember, it does not learn about those networks.
Through what?
Through OSPF or through ISIS or through EIGRP.
Remember what I said.
You don't learn about the destination networks through your dynamic routing protocols anymore.
You don't.
So, you don't know how to get there.
You don't.
But what you do have is you have a LISP forwarding table.
So, you look at your LISP forwarding table.
And in this case, it's empty.
Aw, too bad, right?
Well, what are we going to do?
As a router, I'm going to park the packet.
So, let's park the packet.
Hoeing on to it.
And now we're going to send out a LISP message to the mapping resolver.
Hey, who is 10.0.20.20?
And I'm going to then put my transport layer information on it, which is UDP.
And then we're going to put the source IP, which is what?
Me.
And the destination IP is the IP address of that mapping resolver, which I don't have on here.
So, I just put RLOC of map resolver.
So, whatever its IP address is, that ETR would have to be trained about that.
So, it would be part of their configuration.
So, let's go ahead now and send it to the map resolver.
The map resolver gets it.
And what does it do?
It's going to contact the mapping server.
In this case, it's one and the same device.
So, the mapping server consults its database, and it says this is reachable via that.
So, now that information can be provided to that ETR or the ITR that had asked for it.
So, that information is then created into a packet and sent back.
So, you'll see here that it says the endpoint to RLOC mapping is 10.0.20.20 size 32.
It's via 192.0.2.62.
So, now what can we do in this particular case?
We can take that information, put it in our cache, our LISP cache.
And now we can go ahead and encapsulate.
So, that way there we can go from here to here.
So, think about it.
Just like with GRE, just like with IPsec, what did we do?
We added onto the header to encapsulate.
So, just like with GRE, what's the source?
In this case, the source is going to be 203.0.1.13.87.
What's our destination?
192.0.2.62.
And can we get to each other?
Of course we can because those addresses are part of OSPF.
Those addresses are part of EIGRP.
Those addresses are part of ISIS.
So, we can route to each other.
I just don't know about everything behind, right?
I don't know about everything in every LISP site.
I learned about it how?
With LISP mappings.
So, now let's go ahead and build that frame.
Let's do the encapsulation.
So, we're going to add on our LISP header.
And that's going to include what?
It's going to include information like the LISP header itself,
then the UDP information for transportation,
and then the source and destination IP address.
Notice source is this, destination is this.
So, I can send it across the network.
So, you know, going through all of this stuff, folks,
if we go back to this page here, think about it now.
What information would this be?
Let me clean this up just a bit.
That would be the information of this.
How do I go from here, let's say, over to here?
Those are the two values.
That is the source.
That is the destination.
The users aren't the source.
The users aren't the destination.
You're the source.
You're the destination.
Do I even know about that network and who lives there?
No, I don't, because that network is not advertised in OSPF, EIG, or PRIS, but you are.
You are.
As a LISP router, I know about you.
I know about you.
Do the LISP routers even know about these devices?
No, they don't.
They don't have to, right?
All I need to know, like BGP, there's me, there's you.
If the rest of the network is working, I can get to you.
That's all that matters.
Do I have to know about the rest of the network?
No, I don't.
I don't care about the rest of the network.
OSPF cares about it.
EIGRP cares about it.
ISIS cares about it, but from a LISP standpoint, I don't know.
LISP knows about this.
LISP knows about that, and that, and that, and that.
LISP doesn't know about anything else.
OSPF knows about all the stuff in here, ISIS or EIGRP, but again, doesn't know about any
of that stuff either outside.
Who knows about this outside stuff?
Well, you, as a LISP router, only knows about your local stuff, but the mapping server knows
about everything else.
Ah, there you go.
You see how it's all coming together now?
I know, it's a mind trip.
It really is.
So, now that we have it encapsulated, we send it.
Yay, away we go.
Woo-hoo.
Look at all that.
Guess we've got to have our MTU set properly, don't we?
One of the great things about setting up a LISP environment is that it's recommended
that you use what we call jumble frames and jumble packets.
So, having the ability to transport MTU sizes of like 9,000 folks, 9,000.
I'm serious.
Right?
So, modern day Ethernet interfaces on devices that would support LISP and SD access and
stuff like that, right, we could set our MTUs to 9,000 inside of our environment, and therefore
we could support these bigger packets without having to do any type of fragmentation or
anything on the user's end.
So, we could send 1,500 bytes packets as a user, encapsulate it all, and it would get
to the other side without a problem.
But that only works inside of your environment.
If you decide to leave your environment and go to the Internet, well, that's going to
cause problems, obviously.
So, you know, there's considerations that have to be taken into effect when you're using
MTU because the Internet uses 1,500.
So, now when it gets to this side, this router is what right now?
It's the ETR right now.
It's receiving.
So, now it has to decapsulate.
And then it reads this and goes, oh, okay, I'll send that to you at this particular interface.
And we're good to go.
Fun stuff, isn't it?
All right.
So, now let's think about this situation in this scenario.
We go back to here.
What about everything that's going on over here?
What about everything that's going on over here right now?
Okay.
We call these areas non-LISP sites, non-LISP sites.
That's what they are.
So, you can think of the Internet as a non-LISP site when you are looking at it from the perspective
of SD-Access.
You can look at your data center as a non-LISP site because over there we're doing other things.
We're doing ACI instead.
And so, we have LISP and everything running in here for our enterprise environment, SD-Access.
You got SD-WAN at the edge of your environment.
You got your Internet connections at the edge of your environment.
Right?
So, you got different places.
So, anything that's not part of that SD-Access fabric where you have LISP set up, right,
those are non-LISP sites.
So, we still need to ensure that those non-LISP sites are identified and handled appropriately.
So, here's an example of a non-LISP site.
We can pretend that's the data center.
We can pretend that's the Internet.
It doesn't matter.
But the idea is how do we deal with traffic coming like this or like this?
We need information here that's going to allow that to happen.
So, does that mean if this is the Internet, for example, that we would need a mapping here for 0000
slash 0 via the RLOC address of a router here?
Sure.
Yeah.
So, that way, if we're trying to go to the Internet, we're trying to go to a place like that, right,
if that's the best way to go, we need that information.
So, we need a router sitting there.
And what do we call that router?
We call it a Peter and a Piter.
Again, I don't make up these names.
I just teach you about them.
Peters and Piters.
Peter, Piter, picked a pickle.
So, we've got a proxy ETR and a proxy ITR.
So, for the exam, remember, ETR, ITR, routers that connect your LISP sites to other LISP routers.
Okay.
So, LISP site.
LISP site.
ETR, ITR.
Non-LISP site is Peter and Piter, proxy ETRs and proxy ITRs.
ETRs and ITRs.
Proxy ETRs and proxy ITRs.
So, now, if I'm trying to go, for example, to the data center or the Internet, this would be my ITR,
and now this is my P-E-T-R.
But if the traffic's going this way, then this is my P-I-T-R and my E-T-R.
Know that for the exam.
Be able to identify that in any diagrams they provide you.
So, the Peter receives traffic from LISP sites, right?
The Peter receives traffic from LISP sites, and the Piter sends traffic to LISP sites in this example.
All right.
So, make sure you know EID, RLOC, ITR, ETR, MS, MR, Peter, Piter, LISP site, non-LISP site,
terms and definitions for the certification exam.
If you know those, you'll get all the questions right.
So, that is LISP.
As you need to know it for the exam.
And remember, it might be still a little confusing, but I'm going to show you it in SD-AXIS here momentarily.
But before we get to that, let's talk about VXLAN.
So, VXLAN is a technology that allows us to create tunnels from one point to another point.
Now, pause right there, because this, what I just said, causes confusion with LISP.
Because isn't that what we just did with LISP?
The answer to that is yes.
What I want you to understand is that LISP is both a control plane protocol, and we saw that, right,
learning about who's who, updating the mapping server, using the mapping resolver, right,
figuring out how to go from point A to point B.
That is control plane.
LISP is also data plane, meaning that it can do the encapsulation.
And I showed you the encapsulation when we went through our example like this.
So, it can do both.
It can do both control plane and data plane.
But what you need to understand is that LISP as a data plane protocol for SD-AXIS doesn't work.
LISP as a control plane protocol for SD-AXIS works.
So, we use LISP for the control plane in SD-AXIS, but we don't use LISP for encapsulation.
That's right, we don't.
So, we use LISP for the database.
We use LISP for the RLOCs.
We use LISP for that stuff.
But we use VXLAN for the encapsulation.
And you might be saying, why, Raymond, why?
Well, I'll tell you why in a moment after you learn a little bit about VXLAN.
So, VXLAN allows us to build and extend a Layer 2 network over a Layer 3 network.
That's your answer.
That's the answer you're looking for.
Why, Raymond?
LISP lets you build a Layer 3 network over a Layer 3 network.
That's what LISP does.
Layer 3 over Layer 3.
So, when I was tunneling, I was tunneling Layer 3 traffic over Layer 3 with LISP.
But now with VXLAN, I can tunnel Layer 2 traffic from end to end.
Why is that important?
Well, if I am in VLAN 10 here, and my IP address is this, and this is our site.
Okay, so this is our site for VLAN 10.
And you are here, and you are 10.0.0.10.
And you right now are not in your home site.
You are not in your home site.
How in the world do I talk directly to you?
We are in the same subnet.
We are in the same VLAN.
We are in the same broadcast domain.
But right now, we are separated by this giant Layer 3 network.
How do I broadcast to you?
How do I send a frame to you?
I can't using LISP.
But I can using VXLAN.
Because VXLAN will create a Layer 2 tunnel over that Layer 3 network.
All while preserving the Layer 2 header information.
That's right.
So when this PC builds the frame, the entire frame is preserved.
Whereas with LISP, the frame is destroyed.
Let me repeat that.
With VXLAN, the PC's frame is preserved.
With LISP, the PC's frame is destroyed.
So if I can preserve the frame of the PC,
then I could send that frame over to here.
And you would actually get the frame.
So yeah, Layer 2 anywhere.
That's why this SDAccess solution with TrustSec and all of that stuff works.
Because of this.
Building tunnels.
Remember, tunnels means encapsulation.
So VXLAN is what we call an overlay technology.
You know that for the exam.
An overlay technology that allows us to preserve that Layer 2 header information.
So we use VXLAN for the data plane in SDAccess.
We use LISP for the control plane for SDAccess.
Remember, we're covering these from the perspective of SDAccess
to get you ready for the exam.
There's a lot more to these, though,
because VXLAN was originally introduced to solve problems in our data centers.
And what was the problem with our data centers?
They're getting too big.
And then how is somebody like AWS or Azure or Google Cloud going to support
the billions and billions of servers they have running
and put them wherever they want but still have them in the same subnet,
still have them within the same VLAN?
So if you think about the architecture here,
with VXLAN in my data center, I have my Layer 2, Layer 3 boundary here.
So all the servers are connected to their default gateways.
Notice that my server has the ability to support virtual machines
in any one of those subnets, any one of those VLANs.
But look, every server can do it.
So what's the problem now?
Well, if traffic from VLAN 10 wants to go to this VLAN 10, there is no problem.
Why? Why?
Well, because if that's a trunk link and that's a trunk link,
traffic comes in the trunk link, goes out the trunk link,
no problem in the same VLAN.
There's no issue there because we're connected to the same switch.
But what's the problem if I want to go from here over to here?
What's the problem there?
This Layer 3 environment, right?
This Layer 3 environment is not going to preserve the what?
The frame header of VLAN 10 that is needed by this server,
this virtual machine as the receiver.
It's not preserved.
This wouldn't work.
So you implement VXLAN.
And now what you do is you have this is called a VTEP.
This is called a VTEP.
Virtual Tunnel Endpoint, that's all that means.
And now we tunnel, so we encapsulate from here.
We encapsulate, so that way there I can send the traffic
and preserve all that Layer 2 header information,
decapsulate here, and then now you get the frame
exactly as that device sent it.
Adding what?
Giving you what?
Flexibility, control, expansion, scalability,
scalability to the tune of 16 million possible VLANs with VXLAN
as opposed to 4,000 approximately with VLANs.
Think about it as a service provider.
That's awesome.
Somebody who runs a massive data center, AWS, Azure,
this is what makes it work.
And so now we have what are called VNIs,
which are just your VXLAN number identifier.
So when we used to call it VLAN number, well, these are called VNIs.
Very elastic, right, because we've got Layer 2 adjacencies
across a router boundary.
So I can, from here to here, we can be in the same subnet VLAN
broadcast domain, no problem, across a Layer 3 network.
Also now, when you create your tunnel from here to here,
don't forget that your routing protocol,
your underlying routing protocol can take advantage of load balancing.
So I can go, I can send some traffic this way, some traffic this way,
some this way, some this way, some this way, some this way,
some this way, until it eventually all reaches down to the other side.
Maximizing what?
Maximizing the bandwidth and transportation over the network.
So for VXLAN, I might be VLAN 10 here, sales.
VLAN 10 here, sales.
So let's say I'm .5 and you're .6.
No problem.
We need to talk to each other.
We have our tunnel.
It's called MAC in IP slash UDP tunneling.
So the VTAP is used to what?
Encapsulate and decapsulate.
The VTAP is used to encapsulate and decapsulate.
Wait a second.
Are we running LISP at the exact same time here, folks?
Yes, we are.
So that is also running LISP.
So in this case, LISP, what's this called right now?
What's that called if the traffic's going this way?
Do you remember?
You got to know this for the exam.
That's right.
It's the ITR.
Exactly, the ITR.
And what about over here?
If the traffic's flowing this way, you are the ETR.
There you go.
Right, so the VTAP in VXLAN is the same as the LISP ITR in ETR.
Oh, but you're going to hate me in a moment, folks.
Well, a little bit longer than a moment,
because we'll take a break.
There's also another name for this.
Three different names.
Oh, I hate technology sometimes.
We'll come back to that.
But I do want you to remember,
the VTAP is used to encapsulate and decapsulate traffic in VXLAN.
The ITR and the ETR are used to encapsulate and decapsulate in what?
LISP.
Keep that in mind.
Got to keep these separated for the exam.
That's how you win or lose on this exam, right?
By knowing these things.
So what is happening here?
So let me show you the difference.
Let's go to LISP.
This is going to help you visualize what's going on here.
So with LISP, I want you to realize that if this was my original information,
then that would all be this right here.
This is the same.
Okay, that's the same.
So if that was my original information and I was using LISP,
notice how my Ethernet header is gone.
You see that?
It's gone.
So that is gone.
So in reality, I've got to draw my line like this.
There we go.
That's what it is.
So the Ethernet header is for LISP or going from router to router.
So that header there is not preserving the PC's original Ethernet information.
Okay, that's why we don't use LISP in the data plane for SD access.
Because with VXLAN, you'll see my original header is preserved.
Then I put on my VXLAN header.
Then I put on a UDP header, a new IDP header,
and then the Ethernet header to go from device to device,
and then a new header from device to device, device, device, device, right?
So this is the one that's going to change as we hop from router to router to router to router to router,
like we do in normal routing.
And this is going to be what?
That is the IP address of my LISP RLOC.
That's my LISP RLOC source and destination, which is the VTEP source and destination.
That's why on the last page I said, right, that's your LISP,
I-T-R, E-T-R, VTEP.
So the RLOC address is going to be dumped into there for VXLAN,
source and destination of tunnel, source and destination of tunnel,
while preserving the original IP of the PC and the original Ethernet information from that PC.
It's great stuff.
It's all virtualization, and that's the hardest part.
If you're struggling with it, wrapping your head around it, because it's all virtualization, right?
We have our underlying network running OSPF, EIGRP, IISIS.
That doesn't change.
But now we are doing virtualization on top of that, and only some routers are running this, right?
Like we said, none of these are running LISP in here.
Only the ones on the edge of this environment are running LISP.
The VTEPs are only on the edge of the environment, right?
But it just works because what are we doing?
Encapsulating from end-to-end, end-to-end, end-to-end to make it all work.
So VXLAN only defines the data plane.
Always, always, always.
Meaning VXLAN, folks, is not a control plane protocol at all.
So LISP can be both.
Like I said, LISP can be both a control plane protocol and a data plane protocol.
There's no denying that.
But VXLAN is only a data plane protocol and is used to encapsulate and forward that traffic to the environment.
If it doesn't have a control plane protocol, it doesn't work.
So in this case, we are using what?
LISP as the control plane protocol.
But in your data center, you might be using multi-protocol BGP.
AWS or Azure might be using multi-protocol BGP.
You could even do static unicast, but that's not a scalable option.
But you can totally do it if you want to.
Statically define the endpoints of your tunnels instead of using BGP or LISP.
And then you can even do multicast if you want to.
So I've verified all my notes, and I've got you all prepared for the certification exam right now.
However, it's going to require you to go back and make sure you understand those terms and you understand the definitions.
I encourage you to take it a little bit further and try to build a map in your mind of the networks, of the diagrams I've given you that explain how everything goes.
What's what?
Because on the exam, if you can picture in your head a picture, any picture I provided to you, and then automatically when you see a term, go, oh, that would be there.
That would be there.
That was this.
That was, oh, VXLAN.
That would be a tunnel from there to there.
That's only the data plane.
That is how you're going to get through this exam.
And if you prepare properly, folks, you'll get all the questions right.
They are not hard questions if you just simply understand the fundamentals that I've given you here.
You don't have to go any deeper than that.
But seeing it holistically as a whole, as well as the individual terms, is how you're going to ace these questions on the exam about LISP and VXLAN.