Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

IPSec VTI + tunnel vrf

VPN network of my Enterprise is build using Cisco VTI IPSec technology. At least 50% build over Internet.

My VPN Hub now have many interface's. The key one is LAN interface Gigabit1, WAN Internet Gigabit2 interface and MPLS Gigabit3 interface (CE no label). I want to rebuild my router with vrf. I want to move Gigabit2(Internet) to separate vrf Internet and keep LAN interface (Gigabit1) and MPLS (Gigabit3) interface as is.

Now I have.

Int Gigabit1

Desc LAN

Ip address YYY.YYY.YYY.YYY

Int Gigabit2

Desc Inet

Ip address XXX.XXX.XXX.XXX

Interface tunnel 123

ip unnumbered Lo123

tunnel source Gigabit2

tunnel destination SOME.INTERNET.REAL.IP

tunnel mode ipsec ipv4

tunnel protection ipsec profile Tun-ipsec-profile

I want

ip vrf Internet

rd 1:1000

Int Gigabit1

Desc LAN

Ip address YYY.YYY.YYY.YYY

Int Gigabit2

Desc Inet

ip vrf forwarding Internet

Ip address XXX.XXX.XXX.XXX

Interface tunnel 123

ip unnumbered Lo123

tunnel source Gigabit2

tunnel destination SOME.INTERNET.REAL.IP

tunnel mode ipsec ipv4

tunnel vrf Internet

tunnel protection ipsec profile Tun-ipsec-profile

==

Can I use tunnel vrf Internet in production with IPSec VTI technology? I have find command tunnel vrf in GRE sample. Will tunnel vrf work with IPSec VTI in future IOS release?

Can also put "tunnel vrf Internet"

in

"interface Virtual-Template1 type tunnel"

section?

If answer is YES I got one more question:

=========

Can I use “crypto pki server” with this configuration?

When my VPN Hub configured with no VRF, I can connect to http server port 80 on any of interface's Gigabit1, Gigabit2 and Gigabit3 and get certificates from PKI server. When I move Gigabit2 to vrf Internet I cannot connect to Gigabit2's ip address on port 80 from Internet and so get certificate to autch IPSec session.

==

Sorry my %% English.

Thanks for answer Sergiy.

572
Views
0
Helpful
0
Replies
CreatePlease to create content