dynamic routing via policy based l2l VPN

[Andriy Sidko]

Hi guys.

Just general question.

Could somebody explain why dynamic routing OSPF, EGRP, BGP works w/ problem via route base s2s VPN but not via policy base firewall?

Thank you.

[Rob Ingram]

Hi,
IPSec policy based VPNs only accepts unicast traffic, routing protocols require multicast to establish an adjacency. Where as a VTI or GRE tunnel interface supports multicast. The routing protocol traffic would be encapsulated and routed through the tunnel interface and establish routing adjacency.

HTH

[Andriy Sidko]

so it's possible to use policy based VPN with BGP. is it correct?

[Karsten Iwen]

BGP is a little bit tricky. With its unicast transport you can send BGP through a policy-based VPN. But for the learned routes, this traffic also has to be part of the crypto-policy. Typically a GRE tunnel is used here which can also transport any traffic based on the learned routes.