You could encrypt the GRE tunnel. Everything traverse the tunnel will get encrypted. On CORE-DIA-1
crypto isakmp policy 10 encr aes 256 authentication pre-share group 5 crypto isakmp key cisco address 172.16.0.98 crypto isakmp keepalive 10 4 periodic ! ! crypto ipsec transform-set TEST esp-aes 256 esp-sha-hmac mode transport ! crypto ipsec profile foo set transform-set TEST set pfs group5 ! ! interface Tunnel0 ip address 10.0.0.2 255.255.255.252 ip mtu 1420 ip tcp adjust-mss 1436 mpls ip mpls mtu 1508 keepalive 1 3 tunnel source FastEthernet0/0 tunnel destination 172.16.0.98 tunnel protection ipsec profile foo Just the reverse on the other side. You, and the original poster, could do IPSEC encryption between CEs of the MPLS VPN by using GET-VPN (if don't want to do that encrypted L2TPv3 suggestion :)) http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6635/ps7 180/product_data_sheet0900aecd80582067.html. The CE-to-CE routing remains the same, with added security. ---------------------------------------------------------------------------- ------------------------------------------------------------------------- Luan Nguyen Chesapeake NetCraftsmen, LLC. www.NetCraftsmen.net ---------------------------------------------------------------------------- ------------------------------------------------------------------------- -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Christopher Hunt Sent: Sunday, October 05, 2008 3:01 PM To: cisco-nsp Subject: Re: [c-nsp] MPLS and IPSEC co-working (reviving an old thread) For simplicity's sake let's say that i have 2 7206VXRs running advip-12.4(9)T2. They're in separate cities, each has a direct Internet feed plus a L2 feed between them. Each one is a PE, and running L3VPNs for customers. I use OSPF as an IGP. Everything's working great, but I want to build VPN failover in case the L2 feed between them goes down. Since the backup is a L3 service, MPLSoGRE seems the best option for me. At the same time, I want to encrypt ***at least the customer vrf traffic*** when it uses the L3 MPLSoGRE path. I'm no wiz with IPSec unfortunately an am struggling to understand the process. I've got the GRE Tunnels up and failing over but can't seem to understand how to encrypt the customer data. See attached configs. Anyone have any pointers? See http://markmail.org/message/lob467v2oxc6my5x for original thread onward through the fog, Christopher Hunt -------- Original Message -------- Subject: [c-nsp] MPLS and IPSEC co-workingLink to this message From: Oliver Boehmer (oboehmer) ([EMAIL PROTECTED]) Date: 08/16/2007 09:31:25 AM List: net.nether.puck.cisco-nsp >Andris Zarins <> wrote on Thursday, August 16, 2007 1:44 PM: > >Hi, > >Network setup is pretty trivial - three routers running MPLS (LDP >full-mesh) to support 20+ MPLS VPNs. Tricky part, is that customer is >asking to secure that infrastructure by running IPSEC (3DES). As far >as I know, I can not run LDP over Tunnel interfaces, and crypto-maps >will not help also. Concept of running IPSEC between CPEs doesn't >make sense, as there are no CPEs :( > >Question is - is VRF-Lite plus back-to-back connectivity, like option >A for inter AS MPLS, the only viable option I have, or Im missing >something and there are other, more scalable ways to do it? > well, you can run MPLSoGRE at least on SW-based platforms (like the 7200), haven't checked for 6500/7600 or GSR.. You could also use BGP-L3VPN over L2TPv3 and then encrypt the L2TPv3 traffic using crypto-maps.. Not a complete solution, I know.. oli _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
