Solved: Re: Is it possible to add a firewall between two mpls peers (P-P

pavlosd · ‎08-11-2003

Hi, I was wandering if there is a way between two routers that 'speak' MPLS to introduce a firewall (i.e. pix firewall). I know by default is not possible but perhaps through tunneling etc?

Ragards.

mazhar71 · ‎08-12-2003

Hi,

No, it is not possible at least for today. The packets between P and PE router are not IP packet but MPLS packets (it protocol type is different). One exception to that is penultimate hop poping. If P-H-P is placed and there is no other label stack (ex : no vpn ) the packet is pure IP packet.

Also one of the main idea of MPLS is that P router doesn't know anything except label binding information.

If you want to use firewall somewhere , use it on the CE side not between P-PE,P-P or PE-PE.

Best Regards

View solution in original post

mazhar71 · ‎08-12-2003

Hi,

No, it is not possible at least for today. The packets between P and PE router are not IP packet but MPLS packets (it protocol type is different). One exception to that is penultimate hop poping. If P-H-P is placed and there is no other label stack (ex : no vpn ) the packet is pure IP packet.

Also one of the main idea of MPLS is that P router doesn't know anything except label binding information.

If you want to use firewall somewhere , use it on the CE side not between P-PE,P-P or PE-PE.

Best Regards

Is it possible to add a firewall between two mpls peers (P-PE)