Cisco GET VPN in a scalable VRF Network

[Jonas.Kotyra1]

Hello guys!

My question is a bit of a stretch, but I'm trying anyway. I'm looking for a way to use a vpn as a backup route over the internet for multiple locations of a bigger network. As scaleability is a must-have because at this point it's not fully decided how many locations there are going to be and we want the option to potetially develope more locations, I thought that Cisco GET VPN would be the go-to option, but was stumped very quickly. The Network is definitely using multi-VRF's on the routers and thus should be able to transmit those over the VPN. Now the problem I found was that I would need to create subinterfaces on the interface which is connected via VPN, which I don't think is possible.

I'm a bit of a newbie to networking as a whole and would appreciate any help I can get!

[Philip D'Ath]

GET VPN is no good over the Internet.

Is this an MPLS network?  If so, consider using MPLS over DMVPN.

http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/WAN_and_MAN/ngwane/ngwanempls.pdf

[Jonas.Kotyra1]

It's definitely not an MPLS Network. DMVPN would've been my second approach, but GET VPN sounded very promising from the introduction (any-to-any connectivity and scaleability) and I would've been very excited if there was a small chance to get it to work. Oh well, but thanks anyway for the quick and spot-on answer. :)

[Jonas.Kotyra1]

Follow-up question: Considering that Cisco GET VPN is in this case the state-of-the-art option, would it be at all possible to use it in a non-MPLS Network with mVRF and if not why?

[Philip D'Ath · Accepted solution]

GET VPN basically requires a network with no NAT.

So you can use GET VPN on private networks, like MPLS, VPLS, normal WAN links, etc.  But because when you connect a private network to the Internet you use nat - GET VPN doesn't work.

GET VPN can be great for a service provider, for their internal networks.

[Philip D'Ath · Accepted solution]

If you are not using MPLS, and and have a "reasonable" number of VRF's you can still use DMVPN - you just use a DMVPN tunnel per VRF.

http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/WAN_and_MAN/ngwane/ngwanedmvpn.pdf