I have two sites connected using ipsec, The ipsec is connected using two netscreen boxes and I want to extend VLAN from one site to other Is it possible to achieve that without adding any new component

  • 1
    If you are using the IPSec tunnel to "cluster" the Netscreen boxes into a active/standby pair, I would recommend you seriously reconsider. At least, fully understand the results if your firewalls believe they are both the active firewall.
    – Ron Trunk
    Feb 7, 2017 at 13:32
  • No ,I have independent cluster on each site
    – Mr.lock
    Feb 7, 2017 at 16:05
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin
    Aug 7, 2017 at 16:38

2 Answers 2


So, you want to tunnel Ethernet frames over an IP network that has an IPsec link? Works like any IP network, but you have to be careful with MTU (as always). IPsec links usually have lower maximum transmission unit (MTU) than 1500, but with Ethernet over IP you will anyway run into MTU problems.

The solution may be VXLAN, specified in RFC7348. However, do note that as VXLAN operates over UDP, there is a large amount of overhead. If the IPsec link has an MTU of 1500, then IPsec, UDP and VXLAN together add overheads meaning the Ethernet link has an MTU smaller than 1500. To have MTU of 1500 for the Ethernet link, you will need an MTU bigger than 1500 for the IPsec link, which isn't usually possible in the Internet.

Note that as VXLAN operates on layer 2, it has no way to generate ICMP packet too big messages (which are layer 3 messages). This means that you have to manually configure the MTU to a smaller value for the Ethernet link, or otherwise you will have dropped packets (=no connectivity) or fragmented packets (=performance problems).

GRE (generic routing encapsulation) specified in RFC2784 can also be used to transfer Ethernet frames (transparent Ethernet bridging, Ethertype 0x6558), but firewalls may not like GRE running directly on top of IP as much as they like VXLAN running on top of UDP. However, GRE is an industry standard that is almost unanimously used, so most good quality firewalls from reputable vendors should offer the possibility to allow GRE traffic.

The MTU/fragmentation issues apply equally to all protocols running on top of IP or UDP without TCP inbetween.

Now, what about TCP as the transport for Ethernet packets? The traffic you're transferring through the Ethernet link probably has already one level where TCP is being used, so you would then run TCP over TCP. This is heavily discouraged, as you have then two levels where retransmissions occur, meaning that the performance of the system can catastrophically degrade if there's packet loss. TCP would eliminate MTU problems, but because TCP over TCP can have catastrophical behaviour in the case of packet loss, I don't recommend it.

  • I have old switches which did not support VXLAN . In GRE case mostly I have to add two routers on both sites,right?
    – Mr.lock
    Feb 7, 2017 at 16:04
  • Actually, you already have routed connectivity so routed GRE would have little to offer. If you want GRE transparent Ethernet bridging (and not routed GRE), you need switches/bridges, not routers. You could of course investigate whether an old PC with two NICs could be with correct software turned into an Ethernet bridge. I'm not familiar with such software because my job is implementing the protocols in custom software, not investigating what such existing software exists. So, I know a lot about VXLAN but not much about implementations for e.g. Linux. One of which I'm aware is open vSwitch.
    – juhist
    Feb 7, 2017 at 18:11

You can achieve this by configuring:

  1. L2TPv3
  2. EoMPLS
  3. QinQ

More likely in your case it would be QinQ or L2TP. More information you can find under this link: QinQ, QinQ-2 or juniper guide: here

L2TP guide: L2TP and netscreen guide: netscreen

  • 1
    I don't believe QinQ helps here, as IPsec provides routed, not bridged, connectivity. Also, EoMPLS is a mechanism to transfer Ethernet frames over an MPLS network, which doesn't apply here as IPsec provides routed IP connectivity, not MPLS connectivity. L2TPv3 (not L2TVPv3!) may help, however.
    – juhist
    Feb 7, 2017 at 15:05
  • you right, I've correct spelling. Feb 7, 2017 at 15:12
  • The provided link did not have guide for net screen ,it is for Junos
    – Mr.lock
    Feb 7, 2017 at 16:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.