vrf aware dynamic ipsec

jarvar832004 · ‎10-03-2008

Hi

I need to setup a VRF aware IPSec that can take requests from dynamic (unspecified) sources. This is basically like enabling a home user to connect to his MPLS VPN network with a service provider. Please help with the SP network config, not the CPE.

An appropriate link will also help.

drolemc · ‎10-09-2008

Each IPSec tunnel is associated with two VRF domains. The outer encapsulated packet belongs to one VRF domain, which we shall call the FVRF, while the inner, protected IP packet belongs to another domain called the IVRF. Another way of stating the same thing is that the local endpoint of the IPSec tunnel belongs to the FVRF while the source and destination addresses of the inside packet belong to the IVRF.

One or more IPSec tunnels can terminate on a single interface. The FVRF of all these tunnels is the same and is set to the VRF that is configured on that interface. The IVRF of these tunnels can be different and depends on the VRF that is defined in the Internet Security Association and Key Management Protocol (ISAKMP) profile that is attached to a crypto map entry.

This document helps you configure VRF aware IPSec.

http://www.cisco.com/en/US/docs/ios/security/configuration/guide/sec_vrf_aware_ipsec_ps6350_TSD_Products_Configuration_Guide_Chapter.html#wp1158006

relihanmyburgh · ‎10-14-2008

The document you linked is a very useful document, however the example given is for a static IPSEC to MPLS VPN.

I think the original poster is looking for a dynamic end-point, or to setup something like EzVPN+XAuth terminating in a FVRF. Most of the examples on the Cisco website either terminate the EzVPN or IPSEC tunnels in the global VRF, and all the examples I've seen that are using FVRF's, use static configurations, not dynamic endpoints.

One way of achieving what you are after, is to setup an EzVPN endpoint using this guide:

http://blog.internetworkexpert.com/category/ccie-security/vpn/

... and once that is working using termination in the global routing table, just add the "tunnel vrf [FVRF]" command to the virtual-template interface, and then you will be able to connect to your VPN from a FVRF, with access into another VRF (the IVRF).