Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

VLAN's over internet/IPSec Tunnel

Unanswered Question
Oct 19th, 2005
User Badges:

Hi All !

I have a problem.

I have trunked 5 VLANS from various sites over sattelite and have them all ending on a hub router ,

but my difficulty now is in getting them sent to the HQ over the internet.

I have thought about only 2 ways of possibly being able to do this

1. Get a leased Line :-)

2. and the only feasable alternative ! is to get the VLANs sent per IPSec over the internet but this is my problem....

How do I get a packet from a VLAN into an IPSec tunnel and vice versa ?

What equipment would I need ? (more switches/routers)

Do I need 1 IPSec tunnel for each VLAN to keep them separate from each other ?

Can someone please help.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (1 ratings)
Richard Burts Wed, 10/19/2005 - 05:56
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN


Your drawing suggests that you are thinking about trying to do 5 separate IPSec tunnels from the remote router to the central router. I do not believe that you can do multiple separate tunnels between the same two peer routers.

I have a question about what your real requirements are. Do you really need to get the 5 VLANs to HQ (as separate VLANs) or do you need to get the traffic from the remotes to HQ?

I think it is very problematic to try to get the VLANs separately to HQ. One way to understand VLANs is that a VLAN is essentially a broadcast domain. It is problematic to try to extend a broadcast domain over an Internet connection. It is usually much better to terminate the VLAN at the edge of the cloud and to route over the Internet to establish connectivity between the remote end stations and the HQ.



attrgautam Wed, 10/19/2005 - 06:02
User Badges:
  • Silver, 250 points or more


If you want to extend the LAN or VLAN end to end you could look at whether your SP can do an AToM or L2TPv3.


Fraser Reid Wed, 10/19/2005 - 06:49
User Badges:

Hi Rick,

What I need to do is just keep the traffic separated in any way until it gets to the HQ.

All Remote sites have 5 VLANs.

but VLAN 2 from site 1 is not allowed to speak with any other VLAN from any other site until it gets back to HQ.

so the VLAN traffic has to be completely separate until it has reached HQ.

what I was thinking about (but did not get to work) was just by using IP addresses from the different VLAN subnets with ACL's to keep the data separate on the Hub router in the middle of the sketch before sending it all as 1 data stream over an IPSec tunnel.

Any advances on this thought ?




This Discussion