L2TPv3 across private WAN, VLAN transport advice needed

[CWF Netman]

I've got two major internal networks in different buildings, one has data and Cisco VoIP voice infrastructure (site A), the other has data only (site B). Both sites have their own VTP domains, multiple VLANs (unfortunately with non-unique VLID numbers for all the VLANs), and are connected by a a pair of 3845 firewall routers over fiberoptics with very tight filtering rules since the latter site B is a law enforcement organization and requires tight security.

I also now have several small remote sites, some of which need both voice and data from the parent Site A, some need secure data from site B and voice from site A. The remote sites have available to them, some microwave WAN links ranging from 10Mbps capacity to 100Mbps. The problem is the microwave redundant backhaul link infrastructure is based on Moxa industrial switches which use a proprietary port-based VLAN technology that simply does not play nicely with Cisco 802.1q VLANs. The Moxa switches shut down when they receive 802.1Q tagged traffic when I connect a Cisco switch to them

Therefore I believe I probably need to employ site-to-site VPN links with L2TPv3 tunnelling of the VLANs between the main Site A and B locations to these smaller remote sites (water purification plant, fire stations and a pubsafety vehicle radio shop, and need to use the microwave WAN link infrustructure as my backhaul.

I cannot change out the Moxa switches with Cisco. Their place in the wireless network is carved into stone, and non-negotiable. That wireless network is used primarily for "other stuff", but I need to make use of it's TCP/IP backhaul capability as a private WAN between the two big sites and the remotes.

Given that the typical small remote site might have at most 2 or 3 Cisco phones, and the same number of PC workstations, what is the best choice for an affordable router capable of L2TPv3 tunnelling of two or more VLANs thru a site-to-site VPN to deploy at these remote offices? Cisco 800 series? Or do I need the bigger 1800 series? We're a small city government and on a very tight budget nowdays. I figure I'll probably have to deploy two routers at the sites that need Site A's voice VLAN combined with Site B's data and just use separate physical switches and cabling for the phones at those sites.

Also, could I accomplish what I need with ASA 5505 devices at the remote sites? I've already got a couple of these left over from another project but I'm unsure if they can do L2TPv3 tunneling of VLANs. I've got an ASA 5520 at Site A used as an Internet firewall, and it's got a couple unused ports on it. I've got a couple unused 10/100 ports on each 3845 router at Site A and Site B too, so I've got equipment at the two central main sites already that's probably sufficiently capable of handling the job at those two sites.

It's imperative that I encrypt the LEO data links between Site B and any remote sites, while in transit over the microwave WAN links. It's not so important that I encrypt the voice or data from Site A, while in transit over the microwave links, but I might as well do so anyway.

[Giuseppe Larosa]

Hello Neal,

for remote sites I would consider to use a slightly different approach:

instead of extending Vlans over the WAN wireless mesh you can simply use routing:

allocate two /29 IP subnets to each remote site and configure an 877 or similar device to behave as DHCP server for this two address pools.

The C877 can connect to central site A with a tunnel GRE protected by IPSec, another tunnel GRE protected by IPSec can connect to SiteB.

The use of point-to-point GRE tunnels is very handy because it allows you to have L3 interfaces, the GRE tunnels, that can be used for performing routing either by static routing or also to use a dynamic routing protocol over it like EIGRP or OSPF.

For Cisco IP Phones it is just enough to configure option 150 to provide TFTP server ip address to the phones.

See the following example:

ip dhcp excluded-address 10.110.224.129 10.110.224.132

ip dhcp excluded-address 10.110.224.145

!

ip dhcp pool DATI

   network 10.110.224.128 255.255.255.240

   default-router 10.110.224.129

   dns-server 10.98.112.32 10.55.0.32

   netbios-name-server 10.52.64.37 10.24.128.151

   lease 0 1

!

ip dhcp pool VOICE

   network 10.110.224.144 255.255.255.248

   default-router 10.110.224.145

   dns-server 10.98.112.32 10.55.0.32

   netbios-name-server 10.52.64.37 10.24.128.151

   option 150 ip 10.98.67.5 10.55.61.4

   lease 0 1

!

I don't recommend to extend Vlans with L2TPv3: first of all, the risk is that each broadcast frame is propagated by Central site A or B to each remote site wasting BW, also the requirements on the routes to be deployed on remote site can increase.

L2Tpv3 provides a point-to-point L2 transport but it has to be used in different scenarios like some vlans that need to span between DC and DR site.

In your case moving to a routed design is probably a must. It is needed to build a working solution.

If the number of remote sites is high you can consider to use Dynamic multipoint VPN that allows for better scalability.

see for DMPN

http://www.cisco.com/en/US/docs/solutions/Enterprise/WAN_and_MAN/DMVPDG.html

the point to point GRE over IPSec design guide :

http://www.cisco.com/en/US/docs/solutions/Enterprise/WAN_and_MAN/P2P_GRE_IPSec/P2P_GRE.html

Hope to help

Giuseppe