Re: DLSw and IPSEC

dagates · ‎11-17-2003

Can anybody tell me if you can have a DLSw+ peer and IPSEC tunnel on the same router? We want to utilize DLSw+ on a branch router and use IPSEC across the WAN back to the corporate office?

Has anybody configured this before?

Any lessons learned?

Recomendations?

Thanks!

rclousto · ‎11-17-2003

I've only done this with SNASw in the lab but I don't see any problems doing the same with DLSw. There wasn't anything special I had to do for this. IPSec can be somewhat CPU intensive though I haven't measured it myself to quantify this. You will also be putting all traffic through that router, but maybe you were doing that anyway. So I'd hesitate to recommend this for a large branch but in most cases it should be fine. Sorry I can't give you any specific numbers. Maybe someone who's done this can share their experience.

Regards, Bob

dagates · ‎11-18-2003

Bob, thank you for the information. This is one of those things that it should work... but??? I'm just want to tap somebody's experiance who has deployed this a s a solution. Again thanks for the information.

dmccullo · ‎11-18-2003

Hi David,

Yes, multiple customers have deployed this, and it has been tested and measured in specific customer proof of concept labs. The only issue that I'm aware of is that the MTU size requirements are affected by encryption, so be sure to take that into account.

http://www.cisco.com/en/US/tech/tk331/tk336/technologies_tech_note09186a00801d3a9d.shtml

In terms of performance, everyone's traffic is somewhat different, so it's impossible to say for sure. From what I remember of the proof of concept tests, 2600 routers did DLSw+ and software encryption just fine at DS0 rates.

Rgds, Dan

dagates · ‎11-18-2003

Dan, I noticed that you are with Cisco. I have not contacted any of our SEs about this yet. Can you point or provide me the details on the lab configuration tested and results. Or provide information so I can point the SE in the right direction.

Thanks again

iftikhar.qurashi · ‎02-28-2004

I deployed DLSW+ and IPSEC 3DES on CISCO 2600 router. I had some challenges regarding IOS instability, which were fixed by using correct IOS.

MTU size issue on IPSEC routers with Frame Relay serial interfaces can be fixed by increasing the size to 1600 at interface level, which should be picked by IPSEC automatically.

dagates · ‎02-29-2004

Thank you for the information.