On 08/03/10 15:27, Peter Rathlev wrote:
I'm too stupid to make this work. :-)
What I'm trying is:
- NPE-G1 running 12.4(25c) Ent. IPSec 3DES (c7200-jk9s-mz.124-25c.bin)
- Configured as "standard" MPLS PE in our network
- Loopback-interface to terminate GRE tunnel on "outside" VRF
- Tunnel-interface in "inside" VRF
- No other interfaces apart from the global MPLS enabled
- (Using a SA-VAM2, but I assume this is irrelevant)
- Has to use crypto map + GRE tunnel because of other end
We experience the same problem here on a 2821 with the exact same config
(GRE protected by IPSec, VPN router is a PE).
The irritating thing is that, in the "stable" routing topology it works
because the border router is directly adjacent to the VPN router and the
packets arrive at the VPN router unlabelled. But if we failover to our
2nd internet connection the packets arrive at the VPN router labelled
and it fails :o(
A colleague of a colleague seems to think it's possible to make it work
"with a different syntax" but I'm not sure what that means. The
suggestion made was:
tunnel protection ipsec profile ...
...config format. Possibly this is the bit you're unable to use.
If you find out, I'd love to know.
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
