Connecting three LAN via non private MPLS

[wilson.jr]

Hi

I have three offices in Chile connected via L3 MPLS that can’t be trusted in term of privacy (security). We are planning to connect offices using VPN IPSec, GRE and OSPF on top of it because we use OSPF Company wide. All offices have Cisco 2900 series with IOS firewall routers as an edge router. Should we just use these routers and configure VPN tunnels between offices then configure GRE and OSPF on top or use commercial firewall (PIX) to create VPN tunnels then use routers to configure GRE and OSPF. Any advice will be appreciate.

Wilson

[paolo bevilacqua · Accepted solution]

You don't need the firewalls. The routers can do all what they would do, and some more.

[Roman Rodichev · Accepted solution]

You should use your 2900 and configure DMVPN multipoint tunnels with IPSEC protection on them. This way you will have one tunnel interface to deal with. OSPF works over DMVPN. It's not scalable, but with 3 sites it doesn't matter. You actually gain several advantages by running DMVPN tunnels over MPLS. DMVPN has a nice multipoint QOS support now. The only disadvantage is overhead. With IMIX 512byte traffic, you'll have around 20% overhead (same with regular IPSEC+GRE plus 2 extra bytes for mGRE)

[paolo bevilacqua · Accepted solution]

The only disadvantage is overhead. With IMIX 512byte traffic, you'll have around 20% overhead (same with regular IPSEC+GRE plus 2 extra bytes for mGRE)

Most people forgets that Cisco supports LZS compression for IPSec. Once enabled, the overhead is much reduced.

[wilson.jr]

Thank you all for reply.

I should mention that number of office may grow in the future. Will DMVPN scale easily? What is DMVPN limitation in hub and spoke deployment? On the end of the day what I should do DMVPN or IPSEC+GRE+OSPF? What are cons and pros?

Thank you very much

[paolo bevilacqua]

As long you use the appropriate hardware and configuration, there are no scalability issues.

Beside, there is no real alternative to DMVPN.
Some people use it with many thousands of branches.

Thanks for the nice rating and good luck!