If security is an issue, put any old router in that will do VRFs and configure it with IOS FW or ACLs... You can put an IOS FW "on a stick" with VLAN's going to it...
Or put an actual firewall in place... ________________________________ From: "Ramcharan, Vijay A" <[email protected]> To: [email protected] Sent: Wednesday, December 24, 2008 2:40:53 PM Subject: [c-nsp] IPSec L2L tunnel - traffic from IVRF to other VRFs I've read the doc at http://www.cisco.com/en/US/docs/ios/security/configuration/guide/sec_vrf _aware_ipsec_ps6350_TSD_Products_Configuration_Guide_Chapter.html#wp1027 175 and ignoring the restriction about mapping VRF to VRF traffic have tried (unsuccessfully) to circumvent this restriction. Is it at all possible to terminate an IPSec L2L tunnel in VRF A and then have traffic exit that VRF A to reach resources located in VRF B or possibly the global routing table? I see the security implications naturally of allowing traffic from remote sites to leak across VRFs but if it's not possible then is there some way of providing a "central service" type of resource to a bunch of different sites (assume each site goes into a different VRF) which connect to that resource via IPSec tunnels? [Site A]---IPSec tunnel over Internet---[Hub Router--VRF A--] | [VRF B] | (Central Service) Vijay Ramcharan _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
