LDP and IPSec aren't friendly together on the same interface. A Front-Side VRF (fVRF) is typically used in a vrf-lite/multi-vrf ce situation without LDP enabled. You could try tunnel protection instead of a crypto-map. The order of operations is a key issue here, IPSec has to happen prior to label imposition.
If it is only a CE - PE connection then no problems, but since it is the PE doing the encryption as well. I've done this a couple times where the crypto interface was the vrf interface, and we decrypted/encrypted there and then put the traffic onto a core labeled interface without encryption. David -- http://dcp.dcptech.com > -----Original Message----- > From: Phil Mayers [mailto:[email protected]] > Sent: Thursday, March 11, 2010 4:48 AM > To: David Prall > Cc: 'Peter Rathlev'; 'cisco-nsp' > Subject: Re: [c-nsp] IPSec crypto map on MPLS enabled interface? > > On 03/10/2010 05:44 PM, David Prall wrote: > > You could do MPLSoGREoIPSec > > Maybe, if you control both the design and feature set of both ends. > > But still, it seems pretty clear this is a bug or feature limitation to > me. IP/IPSEC/GRE packets are arriving at/leaving the router. The next > hop adjacency happens to be MPLS. That should not matter. _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
