Hello cisco experts.  We are searching for a Cisco hardware VPN system from the data center to provide tunnels to more then 100 stores. The tunnels are used for the communication of the electronic cash desks , the debit card transactions will have to go true the tunnels to the server in the data center. All the stores have a collection of different ISP's , these provide basic internet subscriptions with dynamic changing WAN IP addresses. The network equipment varies from Experia box to Fritzbox and different type of ZTE or Huawei modems. So there is not much room for config and tweaking on this limited PE equipment on the different locations , also these modems have no support for VPN. After asking around i was told that the Cisco EASY VPN server and Cisco EASY VPN remotes will not work due to the double NAT and the client that will have to send a sort of icmp/ping message , this message will not arrive to the Easy VPN server because of the double NAT... < is this true and if yes is there no way around this ? Will dynamic multipoint vpn (DMVPN) work ?  We want to use refurb CISCO871-K9 routers in the stores behind the ISP PE devices.. these routers have support for DMVPN with the Advanced IP services feature set. (CISCO871-SEC-K9) . And we want a ASA5540-BUN-K9 or ASA5550-BUN-K9 in the data center. Are the Easy VPN software clients a good option , is this really as safe as only hardware VPN tunnels and will this work behind a these ISP modems without issues ? What does a typical store generate in data kbps ? ...  when doing debit card transactions ? I look forward to some real environment examples and hints and tips. Thanks in advance. Edgse  General Overview Q. What is Cisco ® Easy VPN? A. Cisco Easy VPN is an IP Security (IPsec) virtual private network (VPN) solution supported by Cisco routers and security appliances. It greatly simplifies VPN deployment for remote offices and mobile workers. Cisco Easy VPN is based on the Cisco Unity ® Client Framework, which centralizes VPN management across all Cisco VPN devices, thus reducing the management complexity of VPN deployments. There are three components of the Cisco Easy VPN solution: Easy VPN Client, Easy VPN Remote, and Easy VPN Server. Q. What is Cisco Easy VPN Client? A. The Cisco Easy VPN Client enables mobile workers to create a remote-access VPN connection to a Cisco Easy VPN Server. Cisco Easy VPN Client refers to the Cisco VPN Client, which is also commonly referred to as the Cisco Software VPN Client. For more information, please visit http://www.cisco.com/en/US/products/sw/secursw/ps2308/index.html. Q. What is Cisco Easy VPN Remote? A. The Cisco Easy VPN Remote enables Cisco routers and security appliances to establish a site-to-site VPN connection to a Cisco Easy VPN Server without complex remote-side configuration. Cisco Easy VPN Remote is also commonly referred to as a hardware client. For more information, please visit http://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ftezvpnr.html. Q. What is Cisco Easy VPN Server? A. The Cisco Easy VPN Server accepts connections from Cisco Easy VPN Client and Remote, ensures that those connections have up-to-date policies in place before the connections are established. All Cisco Easy VPN Servers are interoperable with all Cisco Easy VPN Client and Remote. For more information, please visit: http://www.cisco.com/en/US/docs/ios/sec_secure_connectivity/configuration/guide/sec_easy_vpn_srvr.html This info makes me think that DMVPN is a option at our example due to the fact we will implement double natting. http://www.cisco.com/c/en/us/td/docs/ios/sec_secure_connectivity/configuration/guide/15_0/sec_secure_connectivity_15_0_book/dmvpn_dt_spokes_b_nat.html It is not uncommon to situate a remote DMVPN spoke behind a NAT box, where a Port Address Translation (PAT) is enabled. When the DMVPN spokes need to send a packet to a destination (private) subnet behind another spoke, they query the Next Hop Resolution Protocol (NHRP) server for the real (outside) address of the destination spoke. The DMVPN hub maintains a NHRP database of the tunnel endpoints and the physical address of the spokes. Here i find good explaination regards software Cisco Easy VPN client : http://www.cisco.com/c/en/us/products/collateral/security/anyconnect-secure-mobility-client/datasheet-c78-733184.html ... View more

Does the RSP720-3C-10GE also support Q-in-Q and VRF-lite without a ES+ or SIP+SPA module ? The RSP720-3C-10GE has 5 interface, so we are wondering if those interfaces can also be configured for 802.1ad (dot1Q tunneling) and VRF-lite. I find this Cisco 7600 series router config document regards to QinQ (802.1ad), i assume it is also for the actual router interfaces.. but i am not sure. : http://www.cisco.com/c/en/us/td/docs/routers/7600/ios/15S/configuration/guide/7600_15_0s_book/802_1ad.html And i find this one for the ES+ line cards : http://www.cisco.com/c/en/us/td/docs/routers/7600/install_config/ES40_config_guide/es40_sw_config/es40_chap4.html#pgfId-1788242 Thanks for the advise.  ... View more