Am 21.01.2010 07:43, John Kougoulos schrieb: > > > On Thu, 21 Jan 2010, Gerald Krause wrote: >> For now I see 3 options for us: >> >> a) implement dedicated VRFs for each branch and map VRFn<->VLANn on >> the RTRs >> b) build a brigded L2 "LAN" from the CPE Dialer-Interfaces up to the >> Firewall-Ethernet Interface (how? bad idea?) >> c) some other brilliant approach... ;-) >> > > > GRE or Ipsec or whatever tunnel from the CPE to (or near) the firewall?
Jep, that might be a way, even not "beautiful" for us. We're moving this customer from an ugly partial/fully IPSec-tunnel meshed setup with many firewalls and IPSec tunnels and I don't want to implement and manage a bunch of IPSec tunnels again. I thought already about some pseudowire or other basic tunnel service (like GRE) from the CPEs to the firewall but I have to deal with redundant tunnel-endpoints as well - the tunneling setup must have an fail-over/redundancy concept. That makes me think about implementing 2 tunnels from each CPE on to 2 additional tunnel-endpoints (between RTR and FW) and configure a basic routing protokoll on top of the tunnels... Hm, that "is" an solution but I'll check further if I have other options before going that way. Gerald _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
