For simplicity's sake let's say that i have 2 7206VXRs running
advip-12.4(9)T2. They're in separate cities, each has a direct Internet
feed plus a L2 feed between them. Each one is a PE, and running L3VPNs
for customers. I use OSPF as an IGP. Everything's working great, but I
want to build VPN failover in case the L2 feed between them goes down.
Since the backup is a L3 service, MPLSoGRE seems the best option for me.
At the same time, I want to encrypt ***at least the customer vrf
traffic*** when it uses the L3 MPLSoGRE path. I'm no wiz with IPSec
unfortunately an am struggling to understand the process.
I've got the GRE Tunnels up and failing over but can't seem to
understand how to encrypt the customer data. See attached configs.
Anyone have any pointers? See
http://markmail.org/message/lob467v2oxc6my5x for original thread
onward through the fog,
Christopher Hunt
-------- Original Message --------
Subject: [c-nsp] MPLS and IPSEC co-workingLink to this message
From: Oliver Boehmer (oboehmer) ([EMAIL PROTECTED])
Date: 08/16/2007 09:31:25 AM
List: net.nether.puck.cisco-nsp
>Andris Zarins <> wrote on Thursday, August 16, 2007 1:44 PM:
>
>Hi,
>
>Network setup is pretty trivial - three routers running MPLS (LDP
>full-mesh) to support 20+ MPLS VPNs. Tricky part, is that customer is
>asking to secure that infrastructure by running IPSEC (3DES). As far
>as I know, I can not run LDP over Tunnel interfaces, and crypto-maps
>will not help also. Concept of running IPSEC between CPEs doesn't
>make sense, as there are no CPEs :(
>
>Question is - is VRF-Lite plus back-to-back connectivity, like option
>A for inter AS MPLS, the only viable option I have, or Im missing
>something and there are other, more scalable ways to do it?
well, you can run MPLSoGRE at least on SW-based platforms (like the
7200), haven't checked for 6500/7600 or GSR.. You could also use
BGP-L3VPN over L2TPv3 and then encrypt the L2TPv3 traffic using
crypto-maps..
Not a complete solution, I know..
oli
version 12.4
hostname CORE-DIA-1
ip cef
!
ip vrf CustA
rd 65000:100
route-target export 65000:100
route-target import 65000:100
!
ip vrf CustB
rd 65000:200
route-target export 65000:200
route-target import 65000:200
!
interface Tunnel0
ip address 10.0.0.2 255.255.255.252
ip mtu 1508
ip tcp adjust-mss 1436
mpls ip
mpls mtu 1508
keepalive 1 3
tunnel source FastEthernet0/0
tunnel destination 172.16.0.98
!
interface Loopback0
ip address 192.168.255.240 255.255.255.255
!
interface Loopback100
ip vrf forwarding CustA
ip address 10.0.0.1 255.255.255.255
!
interface Loopback200
ip vrf forwarding CustB
ip address 10.0.0.1 255.255.255.255
!
interface FastEthernet0/0
description Direct Internet Access - Provider A
ip address 192.168.203.230 255.255.255.252
!
interface FastEthernet1/0
description L2 backbone
ip address 192.168.255.34 255.255.255.248
mpls ip
mpls mtu 1508
!
router ospf 100
router-id 192.168.255.240
log-adjacency-changes
network 10.0.0.2 0.0.0.0 area 0
network 192.168.255.34 0.0.0.0 area 0
network 192.168.255.240 0.0.0.0 area 0
!
router bgp 65000
bgp router-id 192.168.255.240
neighbor 192.168.203.229 remote-as 65001
neighbor 192.168.255.252 remote-as 65000
neighbor 192.168.255.252 update-source Loopback0
!
address-family ipv4
neighbor 192.168.203.229 activate
neighbor 192.168.255.252 activate
no auto-summary
no synchronization
exit-address-family
!
address-family vpnv4
neighbor 192.168.255.252 activate
neighbor 192.168.255.252 send-community extended
exit-address-family
!
address-family ipv4 vrf CustB
redistribute connected
redistribute static
no synchronization
exit-address-family
!
address-family ipv4 vrf CustA
redistribute connected
redistribute static
no synchronization
exit-address-family
!
ip route 172.16.0.98 255.255.255.255 FastEthernet0/0 192.168.203.229
!
mpls ldp router-id Loopback0
!
end
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!
version 12.4
hostname CORE-DIA-2
ip cef
!
ip vrf CustA
rd 65000:100
route-target export 65000:100
route-target import 65000:100
!
ip vrf CustB
rd 65000:200
route-target export 65000:200
route-target import 65000:200
!
!
interface Tunnel0
ip address 10.0.0.1 255.255.255.252
ip mtu 1508
ip tcp adjust-mss 1436
mpls ip
mpls mtu 1508
keepalive 1 3
tunnel source FastEthernet2/0
tunnel destination 192.168.203.230
!
interface Loopback0
ip address 192.168.255.252 255.255.255.255
!
interface Loopback100
ip vrf forwarding CustA
ip address 10.1.1.1 255.255.255.255
!
interface Loopback200
ip vrf forwarding CustB
ip address 10.1.1.1 255.255.255.255
!
interface FastEthernet1/0
description L2 backbone
ip address 192.168.255.37 255.255.255.248
mpls ip
mpls mtu 1508
!
interface FastEthernet2/0
description Direct Internet Access - Provider B
ip address 172.16.0.98 255.255.255.252
duplex full
snmp ifindex persist
!
router ospf 100
router-id 192.168.255.252
log-adjacency-changes
network 192.168.255.37 0.0.0.0 area 0
network 10.0.0.1 0.0.0.0 area 0
network 192.168.255.252 0.0.0.0 area 0
!
router bgp 65000
bgp router-id 192.168.255.252
neighbor 172.16.0.97 remote-as 65002
neighbor 192.168.255.240 remote-as 65000
neighbor 192.168.255.240 update-source Loopback0
!
address-family ipv4
neighbor 172.16.0.97 activate
neighbor 192.168.255.240 activate
no auto-summary
no synchronization
exit-address-family
!
address-family vpnv4
neighbor 192.168.255.240 activate
neighbor 192.168.255.240 send-community extended
exit-address-family
!
address-family ipv4 vrf CustB
redistribute connected
redistribute static
no synchronization
exit-address-family
!
address-family ipv4 vrf CustA
redistribute connected
redistribute static
no synchronization
exit-address-family
!
ip route 192.168.203.230 255.255.255.255 FastEthernet2/0 172.16.0.97 permanent
!
mpls ldp router-id Loopback0
!
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
