How to protect data from ISP over an MPLS/Point to point link?

[Sheraz_35]

Hi,

So we have a couple of dedicated MPLS and point to point Ethernet links provided by an ISP to link all of our offices, the question has arisen if there is anyway we can protect our data if someone from the ISP sniffs it, as it goes across their network, so far we have come up with running an IPSEC VPN over the dedicated point to point links, but it's not great solution, is there any other technology made for this situation that we could use? Essentially, we  want everything that leaves our device to go onto the ISP network to be encrypted. Changing ISP is not really an option since the country we are operating in, everything is owned by the government and they're all the same. 

Thanks

[balaji.bandi]

If you have many links, they also need to talk to each other.

Look at option of DMVPN or GETVPN.

https://www.cisco.com/c/en/us/products/security/group-encrypted-transport-vpn/index.html

[Sheraz_35]

Hi,

Thank you for reply, the only problem is we are using ASA and this does not support the DMVPN or GetVPN, I will see if we can use a router instead.  Thanks for the idea.

Regards

[Dennis Mink]

Whats the issue with ipsec?

[Francesco Molino]

Hi

Ipsec is the good way to encrypt your data and make sure your ISP can't see in clear your traffic.
Now you have different solutions:
- IPSEC L2L: static vpn and time consuming + hard to manage of you have multiple sites and you want a full mesh design.
- DMVPN and GETVPN: uses Ipsec technology but in a more dynamic way for full mesh design. The base design will be in hup to spoke architecture with the ability to have spoke to spoke tunnels built automatically if any communication between remote sites is needed.