Hello all...
Trying to wrap my head around the design and config for GETVPN to facilitate secure links between sites via a MPLS network. I labbed everything up , and all is working as far as MPLS and the routes redistributed between BGP and the CE IGPS etc. All sites have full connectivity and see the routes that they should. The problem comes when I add in a Key Server and begin to activate GDOI members. Of course the connectivity to the KS is fine initially- it sits behind one of the dtech CEs and it's network is advertised. The members register, but once the IPSEC SAs are established at the CEs, I lose my IGP neighbor-ships between the CE and PE routers understandably- which of course drops all the customer routes and connectivity. I'm obviously missing something in the design concept to say the least!
What needs to be done to encrypt the traffic between the CE site routers, and also maintain the peering with the PE VRF interfaces?? What's the best real world practice here?
Attached is a GNS 3 screen shot diagram of the lab. Only concerned with the dtech sites in green. Any help with this would be great, and certainly a solid learning experience for me! thanks in advance....Dennis
