How would I use IPSEC on a trunked VLAN?

It can be configured from 6509 to 3750?

Thanks joseph,

We are a finacial organization and the data is the host and backup host.

The data being transfered is the host data being copied to the backup host once a night.

This is only part of what is going across, but the security guy was concerned that someone may be able to span one of the provider's ports and steal the information.

I don't think it is something to really worry about myself.

We currently have DS3s to the DR site and are moving to the EVPL.

We could link a gigabit ethernet port on the router via subinterfaces and trunk the needed vlans and route the rest on a trunked vlan couldn't we?

But, I was liking the idea of conecting the switches via layer 2 as being cleaner and more efficient.

Another thing to consider also is losing the qos capability with the switches.

Well your security guy is right to worry, but again I would expect the risk to be small. Security people sometimes overlook the cost to implement and support security vs. value of what's being protected. They also sometimes have tunnel vision where they worry, perhaps excessively, about one threat vector possibly leaving others.

Perhaps you might be able to use a routed interface with subinterfaces, but as to the advantage of using L2 between sites, I would recommed L3 (on L3 switches). (One WAN's L2 "advantage" is for those who don't have L3 switches, just L2 switches.) Assuming your DS3 is currently routed, it's unclear, to me, why L2 would be cleaner and more efficient. (You can usually treat the L2 WAN similar to a Ethernet link that you route across.)

It's also unclear to me why you would lose QoS. If the concern is the EVPL only supports L2 CoS, you should be able to set it on a L3 switch as you place frames on the transit L2 path.

Thanks Joseph,

We currently have 2 DS3s routed to the other site, we are replacing that with 100Mbps EVPL, as the EVPL is less cost than one of the DS3s.

We have layer three switches on both ends.

The routers are currenly bridging a couple of the VLANs and rouing the rest between the two sites.

When we get the EVPL, I liked the idea of connecting the two links directly to the switches, rather than go through the router with subinterfaces, then to the switches.

Can you explain this:

"It's also unclear to me why you would lose QoS. If the concern is the EVPL only supports L2 CoS, you should be able to set it on a L3 switch as you place frames on the transit L2 path."

What I was going to do is trunk the subnets that are currently being bridged, and on a seperate VLAN as shown below from a previous post:

"The provider will give you a Layer2 handoff with a customer Vlan.

On the ISP facing interface, you can configure a trunk with the customer Vlan being the native Vlan.

For instance; customer Vlan 100

interface fx/x

switchport trun en do

switchport trun na vl 100

switchport mode trunk

switchport trun all vl 100,101

The 101 Vlan can be the Vlan where you create the p-t-p link for this MetroE so in your switches create Vlan 101 on L2 and L3 and assign the L3 Address as /30 subnet.

For instance:

Main Site

interface vlan 101

ip add 10.101.1.1 255.255.255.252

Remote Site

interface vlan 101

ip add 10.101.1.2 255.255.255.252

Then you can configure your routing protocol of choice and advertise the subnets from each location."

Yes, it likely makes much sense to connect Ethernet handoffs directly to L3 switches. I'm surprised to read you were both bridging(?) and routing across the DS3s.

You might want to double check how you need to interact with the EVPL. Having a VLAN trunk connection to the vendor is common. Passing multiple customer VLANs across that trunk, is not, unless something like QinQ is being provided.

From your provider(?) quotation, it appears you're expected to route across one VLAN (as p-2-p). I.e., are you sure you'll be able to pass multiple VLANs?

Regarding explaining my remark about QoS, it was in response to concern about losing QoS moving to EVPL. My point was, many L3 switches support both L3 and L2 QoS/CoS, so from an equipment perspective, moving connections directly to an L3 switch doesn't always mean you'll lose QoS. However, QoS features between L3 and L2 QoS/CoS are often different as what might be supported on a L3 switch vs. a router. Further, when working with L2 WANs, vendor might not support any direct QoS/CoS (although some WAN technologies don't either).

That quotation was from another NetPro engineer that I had asked some questions.

I will verify with the provider that this is possible.

The bridged/routed scenario was set up a while back from a CCIE that was contracted to do this.

What he did was set the routers up to do frame-relay switching and created four PVCs.

Three are bridged to seperate their traffic from everything else and the fourth is routed, so all other traffic goes across the routed.

It works really well.

I wanted to trunk the three bridged subnets and route the rest of the VLANs across the EVPL.