Hi this conf is VRF LITE + IPSEC. During the test we see the packets don't come back (from a different vrf) to interface with tunnel. We ping from one PC behind the tunnel ip sec (inside the vrf A) to router inside the vrf B (on the same PE). The packets seem to re-enter in the tunnel (by debug ip packet) but they really do not re-enter in the tunnel.
ip vrf B
rd 100:100
route-target export 100:100
route-target import 100:100
route-target import 100:17
!
!
ip vrf A
rd 100:17
route-target export 100:17
route-target import 100:17
route-target import 100:100
!
crypto keyring itea-peer vrf A
pre-shared-key address 172.16.254.110 key pat55200itea
!
crypto isakmp policy 1
hash md5
authentication pre-share
lifetime 3600
no crypto isakmp ccm
crypto isakmp profile itea-peer
vrf A
keyring itea-peer
match identity address 172.16.254.110 255.255.255.255 A
local-address Serial3/0
!
crypto ipsec transform-set InfoTn esp-des esp-md5-hmac
!
crypto map Itea 10 ipsec-isakmp
description ITEA
set peer 172.16.254.110
set transform-set InfoTn
set isakmp-profile itea-peer
match address Serv_Itea
!
ip access-list extended Serv_Itea
permit ip any 193.43.34.0 0.0.0.255 log
!
!
interface Serial3/0
ip vrf forwarding A
ip address 172.19.7.17 255.255.255.252
serial restart-delay 0
crypto map Itea
end
!
interface GigabitEthernet0/3
ip vrf forwarding B
ip address 2.2.2.1 255.255.255.252
duplex auto
speed auto
media-type rj45
no negotiation auto
end
