Layer 2 VPN - Cat6509

[feliperodero]

Is it possible to encrypt a link between 2 Cat6509 belonging to the same LAN (only VLAN 1) without using MPSL ?

We need to create like a VPN (encrypted link) between 2 Cat6509 (using a fiber link) with same addressing (in a flat LAN - no layer 3). What are alternatives ?

1.- Evolve to a Layer 3 architecture and implement VPNs.

2.- MPLS ?

3.- ????

any more ?

(we can have Firewall and VPN module in our Cat6509)

Reading literature we don't find any other alternative.

Thanks

[ehirsel]

What would the reason for encrypting be? On a layer 2 level, security best practices suggest that you do not use vlan 1 for any reason. Assuming your fiber links between the 6509s are already in place and are configured as trunk links (even if you are only using one vlan for now), you may be better off doing this:

1. Remove every device off of vlan 1.

2. Define two new vlans: one as a management vlan and one dummy vlan.

3. Make the mgmt vlan the native vlan on the 6509-to-6509 trunk links

4. Place all unused ports in the dummy vlan.

Doing this will insure that no end-station can perform vlan-jumping attacks on the trunk ports.

Let me know if this is of any help.

[feliperodero]

Thanks for your information.

But we need to encrypt because we are using a "black fiber" and distance between Cat6509 is around 40 Km ... so fiber is crossing public space. For this reason we would like to encrypt data between 2 Cat6500. I know it's difficult to "sniff" in a fiber but ..... !!!

[ehirsel]

I believe that you will need to define that 6509-to-6509 connection as a layer 3 one, and implement an IPSec vpn for the two devices to talk. That would mean reworking your ip network topology, to use two subnets, one subnet for each vlan. The devices off of one 6509 would need to see the 6509 as their default gateway, and the devices on the other would need to be moved to a different vlan and use that 6509 as their default gateway.

Let me know if you need more assistance.