Using MPLS VPN and IPsec together

[chrisayres]

If a Firewall is connected directly to the edge of a VPN network (ie. to an ethernet port on a 7200 that has vrf forwarding enabled) should the FW be able to setup an IPsec VPN across the MPLS network and out the other side to another IPsec VPN device elsewhere on the network.

[wrockall]

Why would you want to do this? MPLS by its very design will allow you to have a VPN accross it, saving the overhead caused by encryption and tunneling.

[Gilles Dufour]

yes you should be able.

MPLS encapsulate IP traffic into a tag/label packet which is then switched through the mpls cloud.

Since ipsec is a sort of encapsulation of ip into ip, it should work across an mpls cloud.