> I'am looking for a good solution to separate multiple branches from each > other by using a central firewall setup. The overall view looks like that: > [...] > > The () components will be under control of the customer, all other > systems are managed by us. The main goals are > 1) separate the branches in general but allow the firewalladministrator > to route between the branches so the customer is able to control his > internal traffic as well as his internet traffic > 2) provide redundancy for all of our components > > At the moment we're providing only ordinary Layer3-MPLS VPNs but in this > case this isn't enough - unless if we plan to implement a dedicated VRF > for each branch. But because the customer has 100+ branches, I dont like > to 'waste' so much VRF instances for one customer. Exist other > approaches/BCPs for those kind of setups? Currently I investigate L2VPN, > AToM, L2TPv3, ... but haven't found a really bullet-proof solution so > far, especially because I have to deal with a lot of dynamically > generated Virtual-Interfaces.
you might want to look at the "Half-Duplex VRF" feature, which allows to build a hub & spoke VPN setup without having to put each "branch" on the same PE into a different VRF. HD VRF will assign a different VRF for upstream and downstream traffic, so packets entering the LNS from the branch will only see the Hub routes, and not the other branches' routes. check out http://www.cisco.com/en/US/docs/ios/12_3/feature/guide/ghdpvrf.html oli _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
