Can I extend MPLS branch by using IPSEC between off site and branch?

[zhiling li]

HI, All:

I want to extend MPLS Branch to some off-site where there is no MPLS service. I wonder if it is possible to build IPSEC tunnel from the off-site to the branch? The tunnel endpoint will be off-site and the branch internet GW. By doing this, I only extend my LAN network by site-to-site VPN.  I do not want to order vrf aware IPSEC since I still need to have service provider involved.

offsite-----IPSEC-----InternetGW---FW---branch core switch---branch CE------MPLS PE

Please let me know it this is possible. If you can find some document or example, that is much better.

Thanks a lot for your helping.

[Peter Paluch]

Hello,

In general, the solution you propose is perfectly valid and should work just fine. From the viewpoint of the provider, you simply add a number of new prefixes on your branch site - and it is not concerned that these new prefixes are in fact located behind an IPsec tunnel.

However, the technical details may be relevant. Is the off-site using private addressing? Is it unique in your VPN? Does your branch access internet via the VPN or via a separate gateway? Are you going to run a routing protocol over the IPsec tunnel? You would need additional GRE encapsulation for that. Do you run a routing protocol towards the MPLS PE? Each of these details may require a special care when configuring this.

If you provide more details we will gladly help you further.

Best regards,

Peter

[zhiling li]

Hi, Peter:

Thanks for your reply, rellay helpful.

Is the off-site using private addressing?

No, they use public IP address.

Is it unique in your VPN?

Yes, unique.

Does your branch access internet via the VPN or via a separate gateway?

Separate GW.

Are you going to run a routing protocol over the IPsec tunnel?You would need additional GRE encapsulation for that.

No. But would you please explain what is the difference by running and not running?

Do you run a routing protocol towards the MPLS PE?

Yes, I want to run ebgp then I have good control of the traffic.

Looking forward for your furthur explaination. Thank you a lot!

Zhiling

[Peter Paluch]

Hello Zhiling,

Sorry for responding late.

 Is the off-site using private addressing?
No, they use public IP address.

Alright. This would require you to configure the routing on your branch so that the networks reachable on the off-site location are reachable via the IPsec tunnel.

Are you going to run a routing protocol over the IPsec tunnel?You would need additional GRE encapsulation for that.
No. But would you please explain what is the difference by running and not running?

If you used a plain IPsec tunnel, you would not be able to run an IGP routing protocol over it, as IPsec does not do well with multicasts - and IGP protocols use multicasts. Also, in most cases, the plan IPsec tunnel is not represented as a Tunnel interface but rather only a crypto map placed on an appropriate egress interface, and there is no way how to tell a routing protocol to work "over" this crypto map, rather than on the interface itself.

Using GRE with IPsec solves both problems. It gives you the the ability of running IGP between the IPsec sites and provides you with the Tunnel interface that represents the tunnel. In fact, using GRE, you can pass any traffic, not just IPv4 unicast, between your sites, and because that is IP+GRE encapsulated, IPsec will be happy with that and will be able to protect it. The downside is, of course, the added overhead of 24 bytes per packet before encryption (new GRE+IP header) including MTU issues that need to be solved.

In recent IOSes, there is a way of configuring a plain IPsec tunnel interface as well, without running GRE. That would not allow you to run IGP easily (only in a per-neighbor configuration) but the tunnel would be represented by an interface which can be considered an improvement. The choice of configuration depends on you.

Best regards,

Peter