If there were ISR on both end then I'd just do vrf-aware IPSec and plumb
L2TPv3 inside of this to transport the vlan; of course this doesn't
answer the original question of doing this with ASA
--
Regards,
Ge Moua
Network Design Engineer
University of Minnesota | OIT - NTS
--
On 02/03/2011 04:26 AM, John Kougoulos wrote:
I believe that you can use ASA for the IPsec part and create GRE
tunnels between the PE and CE (one for each VRF). You would need
though something like ISR on both ends or switches that support GRE in
hardware, so 3560/3750 should change.
Regards,
John
On Tue, 1 Feb 2011, Jeff Kell wrote:
Ran across a new requirement where we would like to extend our campus
standard multi-VRF
"routed building" out to a remote site over the public Internet.
Absent the ideal MPLS or multiple-vlan Metro-E, can you do this
site-to-site over a pair
of ASAs?
Ideally it would be something along the lines of:
VRF A vlan 123-->
VRF B vlan 456-->(terminating on ---> Site ASA ----> Campus ASA ---->
Campus PE (VRF A/B/C)
VRF C vlan 789--> 3560/3750 CE)
Perhaps in simpler terms, bringing the 3 VRF vlans across the wire
onto similar VRF
vlans on the campus side.
On-campus we just run a dot1Q trunk with a vlan for each VRF from CE
to PE.
Can you trunk them into the ASA and do separate tunnels over the
public IP endpoints,
dropping them on separate vlans on the other end?
Without meshing the routing / crossing the streams with respect to
the VRFs?
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
