3

I have a question about connecting two LANs (logically same LAN) over a VPN. In picture below you can see overall representation of our implementation.

Description:

On each side, we have distinct sites with AAA servers (both servers share same base). We have 2 VLANs. For normal users (who can pass authentication) and guests.

Guests can only get to the Internet. Normal users can get to the Internet, and, if needed connect to co-workers at the other site.

So, an IPsec + NAT configuration should work well.

The main problem is outgoing IPsec packets from one router will be "stripped" on the site side of another router. How, in this situation, do we put this packet in VLAN 10 (for normal users) if we lose the VLAN tag information?

I hope I was clear in description of problem.

In short: How do we put packets, coming from IPsec, in VLAN 10 (for normal users), or is there any way to propagate a VLAN?

enter image description here

Improve this question
3
  • Both answers were useful. Even if they did not gave a solution (method) for propagating VLAN(or a t last information about it) through the Internet.
    – char_name
    Commented Nov 5, 2015 at 17:00
  • The reason that the answers didn't give an answer for propagating a VLAN through the Internet is that you don't do that. The Internet is a layer-3 network, and VLANs are layer-2 networks, Layer-2 networks are bounded by layer-3 networks. You really don't want to add that kind of latency to a layer-2 network, anyway.
    – Ron Maupin ♦
    Commented Nov 5, 2015 at 18:50
  • Could I ask why you need to present the same vlan in 2 locations? My understanding is that this design is best avoided, so I would think about redesigning the network, however we use vpls to do this, which might be feasible if both sites are connected to a single isp who provide vpls. Alternatively, could you try L2TP with IPSEC? This should allow you to tunnel layer 2 frames in IPSEC.
    – Vernon Righelato
    Commented Mar 3, 2023 at 12:32

5 Answers 5

Reset to default
1

VLANs are layer-2 domains, and they end at a layer-3 boundary (router). A layer-2 frame is stripped from the layer-3 packet at the first router it encounters. When the layer-3 packet reaches the second router, a new layer-2 frame will encapsulate the packet for the VLAN of the destination subnet.

Improve this answer
7
  • Thank you for answer. But please read my question. I understand the problem. So i ask for any solutions or just any tips. Thank you again.
    – char_name
    Commented Nov 5, 2015 at 15:26
  • There is no solution except to make sure the VLAN has the destination subnet. That is how routing works. Your packet will be put on the VLAN where the destination subnet is. It makes no sense to put it on a different VLAN.
    – Ron Maupin ♦
    Commented Nov 5, 2015 at 15:28
  • But our normal users on same vlan (on distinct sites, vlan 10).
    – char_name
    Commented Nov 5, 2015 at 15:30
  • A VLAN is a layer-2 domain which ends at a layer-3 boundary, so no, the users at two different sites are not on the same VLAN. When the users are separated by routers, they are on different VLANs, no matter if the VLAN numbers are the same. At that point layer-2 plays no part in the end-to-end communication, the layer-3 packet does.
    – Ron Maupin ♦
    Commented Nov 5, 2015 at 15:34
  • I understand very well your point. Ok. So packet will outcome without any tag to inner side of our site from router. And how then our switch decide to which vlan this packet should go? I do not think this router can tag frames in fucntion of ip source/destination. Or can he?
    – char_name
    Commented Nov 5, 2015 at 15:44
2

"VPN" is the wrong term here. That implies a layer-3 (IP) transport between sites.

Based on your diagram, 10.0/16 is the subnet on both sites. For that to work, one would need a bridge between sites. An IOS tunnel interface could achieve this. (as could several other methods) Bridge "VLAN 10" (whatever interface that may be) and the tunnel interface, and it should work [tunnel and vlan remain layer-2 interfaces; the BVI handles layer-3.] Some tweaking would be required to keep the DHCP domains isolated -- since this creates one broadcast domain.

A better solution would be to segment each site into it's own subnet. And place each guest lan into an isolated, local-only VLAN. Then let routing and VPN(s) (tunnel or not) handle everything. VRF and/or ACLs can isolate and restrict guest access.

Improve this answer
1
  • For segmented networks I used Ron Maupin solutin with encapsulation dot1Q <vlan>. So in function of IP source/destination router will put in correct vlan. With my diagram i do not need routing (only if users need go outside). And how you said I will need then isolate guest vlan from normal user vlan by ACL (or another better one solution). Basicaly i tried this: cisco.com/c/en/us/support/docs/routers/… . Tunnel solutions seems good (to transport LVL2 over LVL3 ?). But need to study more about router possibilities.
    – char_name
    Commented Nov 6, 2015 at 11:24
1

If the packet's destination address belongs to the IP subnet on VLAN 10, then the router will forward the packet onto that VLAN. I am assuming that the IP subnet for VLAN 10 is different at each site.

Improve this answer
3
  • Why IP subnet should be different if I want to user feel experience as if it was on same LAN. Or can you be more precisely. Thank you sir.
    – char_name
    Commented Nov 5, 2015 at 15:28
  • 1
    From your comment, I'm guessing they are the same. In this case this won't work. The VPN tunnel acts as a L3 boundary, and you can't have the same subnet in two different places. Another point: since your access control is done at layer 3, which VLAN you are on makes no difference to the user experience.
    – Ron Trunk
    Commented Nov 5, 2015 at 15:32
  • I see. Forgot that with one subnet they will never ask gateway. And yes. Vlan could be different. But for ease of maintaining will chose same vlan. Thank you for answering.
    – char_name
    Commented Nov 5, 2015 at 16:47
1

VxLAN can perform what you needs.

Basically, it's VLAN encapsulation in IP (UDP) packets.

If your routers do not support it you can insert VxLAN gateway in front of them.

Improve this answer
1
  • Good luck with fragmentation and reassembly issues if the underlying transport network does not have a path MTU of 1550 bytes (or 11554 if done with dot1q Tag) from VxVLAN gateway to VxLAN gateway.
    – Marc 'netztier' Luethi
    Commented Mar 3, 2023 at 20:09
0

when a packet with vlan-id goes into an IPSEC tunnel which is an interface actually to a router(it is a forwarding action for a router), typically a router will strip the vlan-id and put the rest of packet into tunnel. This is why you cannot make it on most of the routers(not just Cisco) unless you clearly tell the Router not to do this stripping which is a functionality should be implemented.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.