CloudLabBox
Try the free demo

Cisco Catalyst SD-WAN CLI lab 7 of 14

Segmentation and extranet VPNs

Keep corporate and supplier networks apart in one overlay with VPNs, then open one narrow path between them with an extranet control policy.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 5,120 MB in total. That fits the free demo too.

In your workspace: Shared, then Cisco Catalyst SD-WAN CLI guided labs, then 07 - Segmentation and extranet VPNs

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 60 minutes
Nodes need
6 vCPU, 5,120 MB
Smallest plan
Lite

The scenario

Meridian keeps its corporate network (VPN 10) apart from its supplier network (VPN 20) across the same overlay. Now one supplier portal at Leeds, S1 on 10.12.20.10, must be reachable from the Manchester office, and from nothing else. You prove the isolation, then open exactly that path with an extranet control policy.

NodeSystem IPSiteVPN 10VPN 20
BR110.255.0.1111ge0/1 10.11.10.1/24, H1 10.11.10.10loopback20 10.11.20.1/24
BR210.255.0.1212loopback10 10.12.10.1/24ge0/1 10.12.20.1/24, S1 10.12.20.10

Both edges reach the overlay over the internet (198.51.100.0/24). vBond is .1 and vSmart is .2.

What this course leaves out. There is no SD-WAN Manager (vManage) in any of these labs. A virtual edge can't join the Manager's inventory without a signed device list from Cisco, which these labs don't have. So you won't see the Manager's GUI, dashboards, templates, Policy Builder or zero-touch onboarding. You work at the CLI of the controllers and edges, with a private lab CA and device lists typed by hand. Sending traffic through a firewall at the hub (service insertion) isn't built here or in any other lab. The hosts have fixed addresses set at boot, because the DHCP server on these vEdge images can lock up the edge at start-up.

What you’ll practise

  • Read per-VPN routing in OMP
  • Prove two VPNs are isolated
  • Leak one prefix each way with export-to

The tasks

  1. Start the lab
  2. Prove the isolation
  3. Read a route's VPN and label
  4. Open the extranet path
  5. Prove the narrow path

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Segmentation and extranet VPNs6 nodes and 1 network, 6 links. Every link is listed as text below the diagram.vBondvSmartBR1BR2H1S1INETG0/1eth0G0/1eth0ge0/0eth0G0/0G0/0
6 nodes and 1 network, with the interface names each link uses.
Every link, as text
  • vBond ge0/0 to INET (network)
  • vSmart eth0 to INET (network)
  • BR1 G0/0 to INET (network)
  • BR2 G0/0 to INET (network)
  • BR1 G0/1 to H1 eth0
  • BR2 G0/1 to S1 eth0
Nodes in Segmentation and extranet VPNs, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
vBondCisco vBondvtbond-20.12.21 vCPU, 1,024 MB
vSmartCisco vSmartvtsmart-20.12.21 vCPU, 1,024 MB
BR1Cisco vEdgevtedge-20.12.21 vCPU, 1,024 MB
BR2Cisco vEdgevtedge-20.12.21 vCPU, 1,024 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
S1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Cisco Catalyst SD-WAN CLI guided labs.

  3. Open 07 - Segmentation and extranet VPNs and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Cisco Catalyst SD-WAN CLI labs

All Cisco Catalyst SD-WAN CLI labs

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.