Well, as you know, we are hard at work in a U.S. prepping that environment for our FMC virtualization
that we're going to do in the public cloud.
So cool.
We are at the step where we need to build our route tables for our virtual private cloud, and we also
need to build the security group that we are going to be utilizing with our FMC.
This is a firewall that we are going to be attaching to the virtual network interface or interfaces
of the FMC to protect it from undesired traffic.
Let's get going on these next two AWG prep steps.
All right.
So you remember, I'm sure that we created a VPC that was going to be the virtual private cloud that
would contain our FMC lab.
There you can see the my FMC VPC that we created.
And inside of that VPC, we created an Internet gateway in the last video and we created subnets in
the last video that we were going to be using.
Well, now we need to create the root table and notice there is a default route table for the default
VPC.
And then there's one hanging around here that is garbage, right?
That is from some earlier demonstration that I must have done.
So I'm going to go ahead and delete that root table.
Ah, but it's a main root table and it can't be deleted to.
Oh, so actually I just figured out what this is.
This is a root table that is actually related to ah, let's see, what is this?
Let's get more details.
Ah.
Oh, yeah.
This is the main root table that gets created automatically when we have created our VPC.
Okay, so there is a main root table that gets created automatically, and that's why I cannot delete
that.
Well, what we're interested in doing here is obviously we're going to create a new root table notice.
One of the things that we're doing here is we're not relying on any AWG defaults, and that's kind of
a best practice for some organizations.
They don't want to use the default VPC.
They don't want to use a default root table.
They don't want to use a default security group.
No, they want to carefully construct every component of the environment so that it's very deterministic
and they're not having any default settings.
So let me name this thing FMC in a WAC and I'll just say underscore root, underscore table.
And we are going to be using this in the my FMC VPC of course, and we have the name tag, but we know
we have another tag of use and we know there is a value of FMC in AWB that we've been consistently tagging
all of these resources with.
Okay, great.
So this is a new feature.
I wasn't even aware of this.
It's so fun to do these demonstrations inside of AWB because I always learn of some new feature they've
added and they now have a reachability analyzer to test your route table.
I love it.
So here is our root table and notice we have subnet associations.
So I always like to do this first so I don't forget it.
What subnets are we going to be associating with this table?
Well, I'm going to go in and say it's going to be for sure for now, the management subnet.
So I want to go ahead and associate that management subnet with the route table here.
Now that I've made sure I've got a subnet associated with the routing table.
Trust me, that's very easy to overlook.
Now I'm going to go into the routes and I'm going to edit the routes, because what we're going to do
is we're going to say, hey, for the management subnet, if it needs to get to any destination that
it doesn't already.
Know about.
So we're going to use the default route here of all zeros with the zero mask, then go ahead and send
that to the ah, the internet gateway that we created and we choose that category.
And then from the dropdown we select the Internet gateway that we created in the previous video.
And so I'll save these changes.
And now we have just given the management subnet for FMC, the ability to communicate to the global
Internet.
That's going to be critical for us because we are going to be dialing in from home or from the office,
and we're going to be wanting to communicate with the FMC.
And now the FMC can reach the Internet and can have network address translation take place.
Why?
Well, we built an Internet gateway and then we made a default route pointing to the Internet gateway.
So we've done it.
We have an FMC and a U.S. route table that is going to give us that connectivity that we require.
Now, as our next step, it is time for us to go in and construct the security group that is going to
be attached to the interface for our management traffic.
And we want to make sure that permits the correct protocols from the correct address space as a security
measure.
So I'm going to go ahead and go to the security groups area and I'm going to create a new security group.
It'll be FMC in a WAC underscore SG for security group.
I could give a description of course, and then I need to make sure that I am putting this in the correct
VPC.
Look at that.
A security group description is required.
The security group for the FMC virtual.
All right.
The VPC is our VPC.
That ends D two.
Let's take note of that.
And in fact, I'll go ahead and create the security group right now because I need to make sure right
away that that is the correct VPC.
So let me click on that VPC.
And no, look at that.
It's going into the default VPC.
That is not what we want.
So I'm going to go back here to security groups and I am going to delete that security group that we
just created.
Which one was it?
It was right here.
Notice, by the way, that.
Wait a minute here.
Why can't I delete that?
What is happening?
I should be able to delete that from the actions menu.
Am I missing the delete step?
Oh, let's see.
I want to delete this security group.
Why is it not giving me the option?
Oh, because I didn't scroll down.
I'm a big dummy.
All right, there we go.
That erroneous one is deleted.
I'm guessing what happened here is under the VP CS we didn't, you know, like have our VPC selected
or something.
That was kind of strange how we weren't getting the option to create the security group in the correct
VPC.
Let's try.
Oh, here's where you got to check, obviously, which VPC you want to manipulate.
So we want to manipulate this one right here that ends in c f s right.
Because CFS is the VPC that we want to manipulate.
Okay.
So I have the correct one selected and now I'll create my security group.
It's FMC in a WAC and it is underscore G for security group.
This will allow SSR, H and HTP s to the FMC virtual and we are going to what the heck?
There we go.
If the wrong VPC is selected, just use the X and choose the correct one.
Yeah, that's not the best UI design I've seen.
But anyways.
There we go.
We got the correct one in there.
I'm going to add my inbound rules.
We want to allow S-H.
And here you would put in the subnet of your management domain.
I'm going to cheat and I'm going to allow S-H from any IP.
But do not cheat.
Go ahead and put your subnet in there.
Right.
So I also want to allow HTTPS.
And once again, I'll cheat and say it's open to any IP address.
But we would clearly be putting into that field, right?
Something like 92.30 56.70 6.0 slash 24.
For example, to say that all of our management stations would be coming from the 95, 92, 56, 76
subnet.
All right.
We're going to lock that down to your range.
All right.
Outbound rules, all traffic will be permitted.
The security group is stateful, so it's going to be able to allow appropriate traffic out.
I want to do an add new tag and this is going to be the use tag and it's going to be for FMC in a.
And I'm going to add another tag.
It will be name.
And the name tag will be FMC in a WAC, not root table.
But we will say or I'll spell out security underscore group.
Okay, wonderful.
We have created our security group that we are going to be attaching to the FMC virtual network interface
to protect our FMC.
And we are almost done.
I promise.
Prepping your AWP environment for your VMC.
FMC excuse me from Cisco.
So we have our VPC created.
We've got our Internet gateway created, our subnets created, our route table created.
We have created the security group.
Just a couple more ingredients we're going to be creating here and then we'll be ready to deploy the
FMC into a beautifully constructed AWG environment.