NSX-T 2.5 Getting Started, Part 2 - Service Configuration!
Tags: bgp, datacenternetworkin, ebgp, homelab
Published: 2020-03-08 00:45:02

---
title: NSX-T 2.5 Getting Started, Part 2 - Service Configuration!
published: true
date: 2019-10-05 15:52:00 UTC
tags: BGP,Datacenter Networkin,eBGP,Home Lab
canonical_url: 
---

Now that the primary infrastructure components for NSX-T are in place, it is now possible to build-out the actual functions that NSX-T is designed to provide.

  

A friendly suggestion, make sure your Fabric is healthy before doing this:

[![](https://1.bp.blogspot.com/-ffDaco4hyFg/XZikgf5i4pI/AAAAAAAAAwI/k-vzHRQ03AQLV4M-YRVzAfmH6C4x4ujowCLcBGAsYHQ/s640/5oct-1.PNG)](https://1.bp.blogspot.com/-ffDaco4hyFg/XZikgf5i4pI/AAAAAAAAAwI/k-vzHRQ03AQLV4M-YRVzAfmH6C4x4ujowCLcBGAsYHQ/s1600/5oct-1.PNG)

NSX-T differs from NSX-V quite a bit here. Irregular topologies between edge routers aren't supported, and you have to design any virtual network deployments in a two-tier topology that somewhat resembles [Cisco's Aggregation-Access model,](https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Data_Center/DC_Infra2_5/DCInfra_2.html) but in **REVERSE.**

  

The top tier of this network, or as VMWare calls it in their [design guide](https://communities.vmware.com/docs/DOC-37591), Tier-0, the primary function provided by logical routers in this layer are simply route aggregation devices, performing tasks such as:

- Firewalling
- Dynamic Routing to **Physical Network**
- Route Summarization
- ECMP

The second logical tier, Tier-1 is automatically and dynamically connected to Tier-0 routers via /31s generated from a prefix of your choosing. This logical router will experience a **much higher frequency of change** , performing tasks like:

- Layer 2 segment termination/default gateway
- Load Balancing
- Firewalling
- VPN Termination
- NAT
- Policy-Based Forwarding

Before implementing said network design, I prefer to write out a network diagram.

[![](https://1.bp.blogspot.com/-pjVKp7u5FWM/XZiuIIiwWaI/AAAAAAAAAwU/kV4ODB6UYS4Se4FuWNtWSbblGRBhOkKQQCLcBGAsYHQ/s640/NSX-T%2BRoute-Switch%2BDesign.png)](https://1.bp.blogspot.com/-pjVKp7u5FWM/XZiuIIiwWaI/AAAAAAAAAwU/kV4ODB6UYS4Se4FuWNtWSbblGRBhOkKQQCLcBGAsYHQ/s1600/NSX-T%2BRoute-Switch%2BDesign.png)

  

Let's start with configuring the Tier-0 gateway:

[![](https://1.bp.blogspot.com/-Nd8_tF7-Bfw/XZiu7QZNinI/AAAAAAAAAwc/6d_4qbadr8wX6fjC-mlfxkh51phISeKNQCLcBGAsYHQ/s640/5oct-2.PNG)](https://1.bp.blogspot.com/-Nd8_tF7-Bfw/XZiu7QZNinI/AAAAAAAAAwc/6d_4qbadr8wX6fjC-mlfxkh51phISeKNQCLcBGAsYHQ/s1600/5oct-2.PNG)

We'll configure the Tier-0 router to redistribute pretty much everything:

[![](https://1.bp.blogspot.com/-kILE4DruruA/XZi0rH5gR7I/AAAAAAAAAwo/bB_I515erpokpEClRi8YlO2oKbD7abdRQCLcBGAsYHQ/s640/5oct-3.PNG)](https://1.bp.blogspot.com/-kILE4DruruA/XZi0rH5gR7I/AAAAAAAAAwo/bB_I515erpokpEClRi8YlO2oKbD7abdRQCLcBGAsYHQ/s1600/5oct-3.PNG)

Configure the uplink interface:

[![](https://1.bp.blogspot.com/-lwQy9uD6jm4/XZi003qlovI/AAAAAAAAAws/T-aSX3Z0kaUbC67CGE7AVTl6K13U-mmEgCLcBGAsYHQ/s640/5oct-4.PNG)](https://1.bp.blogspot.com/-lwQy9uD6jm4/XZi003qlovI/AAAAAAAAAws/T-aSX3Z0kaUbC67CGE7AVTl6K13U-mmEgCLcBGAsYHQ/s1600/5oct-4.PNG)

Oddly enough, we have spotted a new addition with 2.5 in the wild - the automatic inclusion of prefix-lists!

[![](https://1.bp.blogspot.com/-pXMui9yL09Q/XZi1HBJLtsI/AAAAAAAAAw4/BvepHbZD00ce_A1Uc8KSCzNpYOZ0ZSFZwCLcBGAsYHQ/s640/5oct-5.PNG)](https://1.bp.blogspot.com/-pXMui9yL09Q/XZi1HBJLtsI/AAAAAAAAAw4/BvepHbZD00ce_A1Uc8KSCzNpYOZ0ZSFZwCLcBGAsYHQ/s1600/5oct-5.PNG)

We also want to configure route summarization, as the switches in my lab are pretty ancient (WS-3560-24TS-E). I'd recommend doing this anyway in production, as it will limit the impact of widespread changes. To pull that off, you **\*should\*** reserve the following prefixes, **even if they seem excessive** :

- A /16 for Virtual Network Services **per transport zone**
- A /16 for NSX-T Internals, allocating /19s to each tier-0 cluster, as outlined in our diagram.

I did so below, and it makes route aggregation or summarization **EASY.**

[![](https://1.bp.blogspot.com/-xhQme6XhhVs/XZi1TzCEThI/AAAAAAAAAw8/HqQnSBUuVPYxySP48G-oqNhyItKrARfgACLcBGAsYHQ/s640/5oct-6.PNG)](https://1.bp.blogspot.com/-xhQme6XhhVs/XZi1TzCEThI/AAAAAAAAAw8/HqQnSBUuVPYxySP48G-oqNhyItKrARfgACLcBGAsYHQ/s1600/5oct-6.PNG)

Now, we configure BGP Neighbors:

[![](https://1.bp.blogspot.com/-Rx9U3M6fSc4/XZi1-AwNK3I/AAAAAAAAAxM/qbWRJ61l-GgI3zf8W8fQ2Ldqcu35STpNwCLcBGAsYHQ/s640/5oct-7.PNG)](https://1.bp.blogspot.com/-Rx9U3M6fSc4/XZi1-AwNK3I/AAAAAAAAAxM/qbWRJ61l-GgI3zf8W8fQ2Ldqcu35STpNwCLcBGAsYHQ/s1600/5oct-7.PNG)

[![](https://1.bp.blogspot.com/-61uqhYobEj8/XZi2D6hoFjI/AAAAAAAAAxQ/nF6clrDzmNgXSjucpuzpoFmbVBuTlGICwCLcBGAsYHQ/s640/5oct-8.PNG)](https://1.bp.blogspot.com/-61uqhYobEj8/XZi2D6hoFjI/AAAAAAAAAxQ/nF6clrDzmNgXSjucpuzpoFmbVBuTlGICwCLcBGAsYHQ/s1600/5oct-8.PNG)

At this point, we want to save and test the configuration. It'll take a while for NSX-T to provision the services listed here, but once it's up, you'll see:

[![](https://1.bp.blogspot.com/-GJoHBmCgjpE/XZi2NZvnpSI/AAAAAAAAAxU/p_oPiM8DZvkTHXKnBOnSNQxO-R6N1UyJQCLcBGAsYHQ/s640/5oct-9.PNG)](https://1.bp.blogspot.com/-GJoHBmCgjpE/XZi2NZvnpSI/AAAAAAAAAxU/p_oPiM8DZvkTHXKnBOnSNQxO-R6N1UyJQCLcBGAsYHQ/s1600/5oct-9.PNG)

Check for advertised routes. Only routes that exist are aggregated, so you should only see 10.8.0.0/16:

[![](https://1.bp.blogspot.com/-8ppG6HN9gMU/XZi2ee3XhzI/AAAAAAAAAxg/_wOjS_cCnfg4BxzokKVOZ9EnCAJ0W_imQCLcBGAsYHQ/s640/5oct-10.PNG)](https://1.bp.blogspot.com/-8ppG6HN9gMU/XZi2ee3XhzI/AAAAAAAAAxg/_wOjS_cCnfg4BxzokKVOZ9EnCAJ0W_imQCLcBGAsYHQ/s1600/5oct-10.PNG)
  

[![](https://1.bp.blogspot.com/-JSF6NuR-tMc/XZi2fKNE_lI/AAAAAAAAAxk/vi_WMw5pDPM1G3ydoBKyOffKdWczEYV_ACLcBGAsYHQ/s640/5oct-11.PNG)](https://1.bp.blogspot.com/-JSF6NuR-tMc/XZi2fKNE_lI/AAAAAAAAAxk/vi_WMw5pDPM1G3ydoBKyOffKdWczEYV_ACLcBGAsYHQ/s1600/5oct-11.PNG)

As a downside, I have prefix-filtering to prevent my lab from stomping on the vital pinterest and netfix network, so I had to add the new prefixes to that:

[![](https://1.bp.blogspot.com/-G9rzUVnRtxI/XZi3kXe5G9I/AAAAAAAAAxw/HLAGlajdthQJabTB6S_urq9ori1DkTTLwCLcBGAsYHQ/s640/5oct-12.PNG)](https://1.bp.blogspot.com/-G9rzUVnRtxI/XZi3kXe5G9I/AAAAAAAAAxw/HLAGlajdthQJabTB6S_urq9ori1DkTTLwCLcBGAsYHQ/s1600/5oct-12.PNG)

That was quite a journey! Fortunately, Tier-1 gateway configuration is MUCH simpler, initially. Most of the work performed on a Tier-1 Gateway is Day 1/Day 2, where you add/remove network entities as you need them:

[![](https://1.bp.blogspot.com/-5asetH-b_ok/XZi4Ylkyq1I/AAAAAAAAAx4/6Yj2lWIXhl4h5SXReIMgyg5C0lF1C7i6ACLcBGAsYHQ/s640/5oct-13.PNG)](https://1.bp.blogspot.com/-5asetH-b_ok/XZi4Ylkyq1I/AAAAAAAAAx4/6Yj2lWIXhl4h5SXReIMgyg5C0lF1C7i6ACLcBGAsYHQ/s1600/5oct-13.PNG)

Let's add a segment to test advertisements. **I STRONGLY RECOMMEND WRITING A NAMING CONVENTION HERE**. This is one big difference between NSX-V and NSX-T, where you don't have this massive UUID in the port group obfuscating what you have. Name this something obvious and readable, your future self will thank you.

[![](https://1.bp.blogspot.com/-8o30PJ2YeH0/XZi5O173qxI/AAAAAAAAAyE/PUJPDt0Q7nAhsjhSvURZ-Tv_ONWvV9VqwCLcBGAsYHQ/s640/5-oct-15.PNG)](https://1.bp.blogspot.com/-8o30PJ2YeH0/XZi5O173qxI/AAAAAAAAAyE/PUJPDt0Q7nAhsjhSvURZ-Tv_ONWvV9VqwCLcBGAsYHQ/s1600/5-oct-15.PNG)

Hey look, new routes!

[![](https://1.bp.blogspot.com/-6zm39jJzZHo/XZi5v9RVWwI/AAAAAAAAAyQ/tJCcX3J59r0__cV4cfSzxbNuLXWZAKNcwCLcBGAsYHQ/s640/5oct-16.PNG)](https://1.bp.blogspot.com/-6zm39jJzZHo/XZi5v9RVWwI/AAAAAAAAAyQ/tJCcX3J59r0__cV4cfSzxbNuLXWZAKNcwCLcBGAsYHQ/s1600/5oct-16.PNG)
  

[![](https://1.bp.blogspot.com/-psyTG2XnZS0/XZi5v1OVzHI/AAAAAAAAAyM/cfC7Q9Yk84I1TwRs3MJDDxPD_163rO48QCLcBGAsYHQ/s640/5oct-17.PNG)](https://1.bp.blogspot.com/-psyTG2XnZS0/XZi5v1OVzHI/AAAAAAAAAyM/cfC7Q9Yk84I1TwRs3MJDDxPD_163rO48QCLcBGAsYHQ/s1600/5oct-17.PNG)

  

As I previously mentioned, these segments, once provisioned, are just available as port-groups for consumption by other VMs on any NSX prepared host:

[![](https://1.bp.blogspot.com/-FR-rq2YLjc0/XZi76MlXXsI/AAAAAAAAAyg/dpBAnzJ-VV4JkKRrgy2CZI1jsXLj3AczwCLcBGAsYHQ/s1600/5-oct-18.PNG)](https://1.bp.blogspot.com/-FR-rq2YLjc0/XZi76MlXXsI/AAAAAAAAAyg/dpBAnzJ-VV4JkKRrgy2CZI1jsXLj3AczwCLcBGAsYHQ/s1600/5-oct-18.PNG)

Next, we'll configure NSX-T to make waffles!