I need to setup a VRF aware IPSec that can take requests from dynamic (unspecified) sources. This is basically like enabling a home user to connect to his MPLS VPN network with a service provider. Please help with the SP network config, not the CPE.
Each IPSec tunnel is associated with two VRF domains. The outer encapsulated packet belongs to one VRF domain, which we shall call the FVRF, while the inner, protected IP packet belongs to another domain called the IVRF. Another way of stating the same thing is that the local endpoint of the IPSec tunnel belongs to the FVRF while the source and destination addresses of the inside packet belong to the IVRF.
One or more IPSec tunnels can terminate on a single interface. The FVRF of all these tunnels is the same and is set to the VRF that is configured on that interface. The IVRF of these tunnels can be different and depends on the VRF that is defined in the Internet Security Association and Key Management Protocol (ISAKMP) profile that is attached to a crypto map entry.
This document helps you configure VRF aware IPSec.
The document you linked is a very useful document, however the example given is for a static IPSEC to MPLS VPN.
I think the original poster is looking for a dynamic end-point, or to setup something like EzVPN+XAuth terminating in a FVRF. Most of the examples on the Cisco website either terminate the EzVPN or IPSEC tunnels in the global VRF, and all the examples I've seen that are using FVRF's, use static configurations, not dynamic endpoints.
One way of achieving what you are after, is to setup an EzVPN endpoint using this guide:
... and once that is working using termination in the global routing table, just add the "tunnel vrf [FVRF]" command to the virtual-template interface, and then you will be able to connect to your VPN from a FVRF, with access into another VRF (the IVRF).
Hi everyone, I would like to thank you in advance for any help you can provide a newcomer like myself!
Im studying the 100-105 book by Odom and am currently on the topic of Port security. I purchased a used 2960 and I'm trying to follow a...
While deploying a number of 18xx/2802/3802 model access points (APs), which run AP-COS as their operating platform. It can be observed on some occasions that while many of their access points were able to join the fabric WLC withou...
I am going to design and build an LAN network under a tunnel underground with long distance between the switches.
I will have 2 Catalyst switches and 8 Industrial IE3000, and they will be connected with fiber.
For now I am planning on use Layer-2 s...