Gre Tunnel to use for internet whereas MPLS link to use DC segments

[zeeshan.anwar]

Hi Team,

I have below scenario here:

Branch Core Switch---> Branch Router --->MPLS Cloud ----> Hub Router---> Core-Switch ---> WAN firewall
                                                                                                                                                       

                                                                                            Internet link--->   Internet Switch --->    Proxy Firewall

All my DC segments are behiind the WAN firewall.Which i am able to able advertise in Bgp Network.However i want user to have internet access via Proxy firewall.For this i am thinking to create a GRE tunnell from Branch router to Proxy Firewall(Proxy Firewall is connected to Internet Switch).I am struggling to understand what should be the source ip of my gre tunnel is th ip of MPLS cloud provider PE of remote location or it will will be Lan interface of router as the core switch has all data and wireless subnets for internet users.

I am attaching existing setup configs as well

[balaji.bandi]

Looking at Branch Router config, it was not clear in line with your diagram.

Rather text do you have picture diagram for us to understand the network connected.

Does branch have 2 Links MPLS and Internet ?

Generally Most deployed setup for the http and https traffic route via Proxy

1. Option 1 using manual configuration via browser or WPAD or PAC File.

2. Redirect using WCCP based on the destination via proxy.

[zeeshan.anwar]

Here is the diagram.Branch only have MPLS link no internet

[Richard Burts]

@balaji.bandi asks a good question about whether there are 2 links from the Branch. My understanding from your description is that Branch has a single link to Hub router. Is that correct? 

If you want a GRE tunnel from Branch router to Proxy Firewall then the source would be the outside interface of Branch router and destination would be the outside interface of Proxy Firewall. And similar addressing at Internet switch and Proxy firewall at the remote side. And you will need to be careful with netting and routing between sites so that tunnel traffic is appropriately natted and routed.

This will be a fairly complex thing to configure and I wonder if the complexity is worth it? What are benefits of Branch users getting Internet access via Proxy firewall as compared to Internet access via WAN firewall?

[zeeshan.anwar]

Thanks for the yes branch has a single MPLS link to Hub.

Asper design of firewall all users are behind a proxy firewall for internet not by WAN firewall