Site to Site VPN with L2 using IPSEC / GRE with layer 2

[brandon-comer]

Greetings, 

I am trying to configure 2 Catalyst IR1101 industrial routers to each other in a VPN using LTE.

I have them set up and working now with GRE/IPSEC, but I am ultimately wanting Layer 2 forwarding for a very proprietary piece of equipment. 

Right now, I can't even seem to find any examples for Bridge Domains etc. that feature only 2 devices. 

So, any suggestions for configuration options would be appreciated. 

Thanks, 

Brandon

[MHM Cisco World]

if you use VPN between two devices 
then try use xconnect to forward l2 traffic between devices 

MHM

[brandon-comer]

This router doesn't support xconnect, unfortunately. I am on IOS-XE 17.10.01a .

[Jonatan Jonasson]

Would using vxlan work for your scenario?

There's a config example in one of the 1101 configuration guides:

https://www.cisco.com/c/en/us/td/docs/routers/access/1101/software/configuration/guide/b-cisco-ir1101-scg/m-vxlan-over-gre.html

From the guide: "This solution provides the customer the ability to extend an L2 broadcast domain over an L3 IP network. The GRE tunnel facilitates connection of disjoint L3 network subnets over which VXLAN packets can be transferred."

[brandon-comer]

That looks like exactly what I'm looking for.  

I'm going to give it a try!

[vishalbhandari]

@brandon-comer To configure Layer 2 forwarding between two Catalyst IR1101 routers over LTE, you'll need to use a solution like Ethernet over GRE or L2TPv3, as traditional GRE/IPSec only supports Layer 3. Start by creating bridge domains or bridging virtual interfaces (BVIs) on both routers, then encapsulate the Layer 2 traffic using L2TPv3 over the IPSec tunnel for security. Unfortunately, examples for this specific setup are limited, but Cisco's configuration guides on L2TPv3 and bridging are a good starting point. Ensure both devices have the appropriate IOS features enabled and test with small subnets to verify Layer 2 connectivity.