Encryption

[chemudupaty]

can we build IPSEC between C9300 and Cisco ASR 1002? if not, any other options to configure data encryption with these hardware models using the mpls provider.

[MHM Cisco World]

https://blogs.cisco.com/networking/finally-ipsec-on-a-catalyst-switch

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/17-7/configuration_guide/sec/b_177_sec_9300_cg/configuring_ipsec.html

from this two link you can use IPsec but I think you need to config VTI not use crypto map 
MHM

[chemudupaty]

Thank you! From what i have read on this link i cannot configure IPSEC using the MPLS cloud network. I would either need a point-point or internet circuits installed to build the tunnel?

[MHM Cisco World]

correct 
MHM

[chemudupaty]

can you let me know what would be the reason why we cannot configure ipsec on mpls?

[MHM Cisco World]

we can config Crypto map under interface toward MPLS but you mention one side is C9300 so crypto map can not apply under the interface so we need VTI and protect by IPsec profile 
MHM

[chemudupaty]

Got it. Do you think we can do it with C9300-X or C9500 models ?