4

I'm looking to add security on a LAN to LAN link that we have in my network. This LAN to LAN link is used to extend vlans over 2 sites (local & remote).

For now, the diagram is this one :

diagram-l2l

I have to add the security features with 2 Cisco 891 routers (this is not a choice but a constraint).

I am looking to change the network architecture following this diagram :

l2tp ipsec

In fact, the idea here is to add a 891 router between my L3 switch and the ISP's equipment, and to do this on both sites of course.

Then, I will have to create L3 connectivity between my 2 routers using the lan to lan link. This way I can encrypt the packets using IPSEC.

But to be as transparent as possible for the network, I will have to encapsulate the L2 datagrams coming from my network into L2TP packets, which will then be encrypted via IPSEC and sent over the LAN to LAN link to the remote router.

Am I correct in these assumptions ? Is this something that is technically possible ?

I don't really know how I can interconnect my 891 router with the ISP's equipment, for starters.

Thanks for the help Jeremy

Improve this question
4
  • Are you just trunking two VLANS? Are there plans for more?
    – Ron Trunk
    May 19, 2014 at 18:52
  • Also, what version are you using on the 891s
    – Ron Trunk
    May 19, 2014 at 18:58
  • @Ron Version is 15.2.4 M5 (UNIVERSAL c890-universalk9-mz.152-4.M5.bin). No plans for more vlans on the trunk though. One of the vlan is just an interconnection vlan.
    – Jeremy G.
    May 21, 2014 at 8:12
  • Can your ISP do Q-in-Q tunneling? As far as management you may just want to do out-of-band on a seperate subnet
    – user20196
    Nov 1, 2015 at 20:25

1 Answer 1

Reset to default
3
+50

Well, You can extend the LANs with L2TPv3 and protect the setup with IPsec.

Here's example configuration: https://www.softether.org/index.php?title=4-docs/2-howto/L2TP//IPsec_Setup_Guide_for_SoftEther_VPN_Server/Cisco_IOS_L2TPv3//IPsec_Edge-VPN_Router_Setup

And here's another one, modern, using FlexVPN - unfortunately, depending on your IOS version, you may not be able to use it: http://www.cisco.com/c/en/us/support/docs/security/flexvpn/116207-configure-l2tpv3-00.html

I did some testing for that kind of setups, bear in mind transporting all the L2 traffic over IP will cost you bandwidth. If you need any help in setup/troubleshooting, let me know.

As for more obvious problem - connecting 891's to ISPs - just point default network to them as gateway. From this setup the routing itself is typical in terms of configuration.

Improve this answer
8
  • The topology I want to put in place is exactly the one shown on the FlexVPN page you provided. My main problem as you explained is that my ISP equipment is supposed to receive a L2 link (trunk with vlans 7 & 10) - NOT a L3 link. Can I just connect the L3 interface from my 891 Router to my ISP and hope I can get connectivity to its peer on the other side of the ISP L2 link? It does not sound as if it would work.
    – Jeremy G.
    May 21, 2014 at 8:01
  • If you're given L2 service with 802.1q tags as different "lines" for that service, you can even connect simple switches and the L2 communications on those two VLANs should work without problem. You don't need any L3 to provide communication. In this scenario, if you'd like to protect the service, You can use MacSec on Catalyst switches to perform wire-speed L2 encryption of the traffic going both ways.
    – Łukasz Bromirski
    May 21, 2014 at 20:05
  • Indeed, I know about MacSec, but it is too expensive to deploy. I have to do it with L2TP over IPSEC but I can't really figure out the last part which is how to interconnect my L2 lan-to-lan ISP link with my L3 router used for IPSEC.
    – Jeremy G.
    May 22, 2014 at 7:43
  • You need to add bridge to IPsec endpoint, and provide IPsec for bridged traffic. L2TPv3 will enable the L2 traffic bridging to other IP endpoint, IPsec will provide confidentiality. If IPsec is to be used, you need IP of tunnel endpoints, so while your ISP provides L2, if you need routers to transport traffic, you need to establish L3 gateways that will tunnel L2 traffic. Please take a look at the configs.
    – Łukasz Bromirski
    May 22, 2014 at 8:35
  • Lukasz : I wish to add a management IP on my IPSEC Routers. Is this possible via the use of Loopbacks ? I tried it but can't make my routers reachable from the network as they are already tunneling all incoming traffic. I am thinking about adding an out-of-band cable to provide management capabilities.
    – Jeremy G.
    Jun 23, 2014 at 16:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.