VRF based IPSec VPN

[alexia_net]

Hello,

I am trying to implement in my lab a vrf aware ipsec. 

There is something that I am missing in my configuration, but I cannot identify it. 

Attached the configuration I am trying to implement on both routers.

On the same routers I have managed to implement non-vrf based IPSec VPN, on different WAN IPs.

But I have some challanges with the VRF based VPN.

Any feedback, much appreciated.

Thank you!

[Rob Ingram]

Hi @alexia_net 

I would have thought the ISAKMP profile should be in the "global" vrf not "CustX".

[alexia_net]

Hello Rob,

You mean like this?

crypto isakmp profile prof-15
keyring key-15
match identity address 172.100.101.1 255.255.255.255
exit

Best regards!

[Rob Ingram]

@alexia_net 

Yes, if no vrf defined it would be in global.

[alexia_net]

Hello,

It still does not work.

I still do not get answer from remote router with wan 172.100.101.1, towards local router with wan 172.100.101.2, using

ping vrf CustX 10.3.113.1

or 

ping 10.3.113.1 soruce lo3

10.3.113.1 is on the local router

The same when I try from local to remote, towards 10.3.114.1

Best regards!

[alexia_net · Accepted solution]

I have managed to make it work. However, I do not understand why I cannot send traffic from the LO interface. It worked after creating a VM and connecting it into the router, in to that specific VRF. I had to remove the LO interface and create a physical interface, forwarding the VRF traffic and used it at GW for the VM.

[alexia_net]

I recommend this video

https://www.youtube.com/watch?v=04DWdHPk1J0