Hi, Thanks for replying!

Ordinarily, I would agree with you but the end Customer only wants the link segments encrypted. I am currently looking into 802.1Q tunneling. Is this usable on 2960 switches and is there any gotchas to watch out for? Topology is actually 4 switches and two links in a redundant loop between the sites. Keeping STP running would be nice (-:

Regards ... John

Hi,

Yes you could use 802.1q instead of ISL, this is the standard method of doing trunking anyway.

You can do 802.1q on almost all cisco switches, as its the industry standard so it has to be supported for compatiblity with 3rd party equipment.

Obviously the encrptions devices will need to support 802.1q.

HTH

LR

Yep, that's the problem. Crptos do not natively support dot1Q so I was hoping to use dot1Q tunneling over an un-tagged link where the crytos sit in the un-tagged bit. No challenge there then (-;

S'pose the first question is do 2690 switches support Dot1Q tunneling?

Hmmm

Hi,

No they do not im afraid.

LR

Hi Josh

I had to solve a very similar problem to yours, and the solution I came up with was to use L2TPv3 (layer 2 tunnelling protocol) over IPSEC. I used the same device (a pair of old 1700 series routers at each end) to create both the L2 tunnel and the IPSEC tunnel, but in your case you are using a separate device to do the encryption. You just need to create the L2 tunnel between 2 devices which are on the unencrypted side at each end. You need to ensure that the 2 devices can route to each other.

Thanks Chaps,

I believe that my best option is to offer the Customer two choices:

1. Buy some routers and use L2TPv3

2. Upgrade the switches and user 802.1Q tunneling.

All the best ... Josh