You could do MPLSoGREoIPSec -- http://dcp.dcptech.com
> -----Original Message----- > From: [email protected] [mailto:cisco-nsp- > [email protected]] On Behalf Of Peter Rathlev > Sent: Wednesday, March 10, 2010 12:07 PM > To: Phil Mayers > Cc: cisco-nsp > Subject: Re: [c-nsp] IPSec crypto map on MPLS enabled interface? > > On Tue, 2010-03-09 at 13:35 +0100, Peter Rathlev wrote: > > And the encrypted traffic leaves the box tagged too. > > I assumed a little too much here. :-) > > It turns out that the traffic leaves the box unencrypted unless it > originated on the box itself. So ping inside the tunnel interface works > fine, but traffic arriving from outside the box only gets GRE > encapsulated, not IPSec. MPLS always comes on top. > > I ended up having to use a non-MPLS interface as the "outside" > interface > to make the box actually encrypt things. > > I thought I could pull this off on a 7200. They're so versatile. :-) > > -- > Peter > > > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
