On Tue, Oct 7, 2008 at 12:54 AM, Oliver Boehmer (oboehmer) <[EMAIL PROTECTED]> wrote:
> What is the VPN connection for? It's not just the one VPN; there's likely to be a need for several. Long story short; the backbone network is going to be connected to several different services (the Internet and various restricted networks), and each downstream connector will be accessing probably two or more of the restricted services (Customer A gets service X and Y but not Z, Customer B gets service X and Z but not Y, Customer C gets service Z only). One of the 'common' services among all is likely to be a local 'intranet' providing connectivity between all the customers. The customers (as well as the PEs) are in multiple geographic locations, but the backbone network will be connected directly over dark fiber. > Why do the two customers have to see > each other via the VPN link as well? Well, they don't *have* to in this particular VPN. I was thinking of the above described Intranet service. If they're communicating already over the 'Intranet' service, is there any reason for them to also learn routes to each other via the 'Internet' service? > >You say you want to offer the > VPN/VRF for internal services.. Then I would expect a different > route-target import/export policy, i.e. something like a central > services VPN: > > ip vrf Cust-A > route-target export 65001:100 > route-target import 65001:100 > route-target import 65001:900 > > ip vrf Cust-B > route-target export 65001:200 > route-target import 65001:200 > route-target import 65001:900 > > ip vrf services > route-target export 65001:900 > route-target import 65001:900 > route-target import 65001:100 > route-target import 65001:200 > > so both customers can communicate with your "services", but they don't > see each other via the VPN.. I think the central services idea may be what I'm looking for. > > I would question the overall VPN design. Why build a VPN where your > customers have full connectivity between each other? Why don't you just > let them communicate via the global routing table? They may not both subscribe to the *regular* Internet service, so having them communicate via the local Intranet service will be desired. _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
