- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
11-22-2021 03:20 AM
In a L2 connection through ISP with MTU less of 1600bytes, I´m using FIGWs for fabric extend (VXLAN) and fragmentation & reassembly to establish isis adjacencies without problem.
Now I want to add IPSEC but I review all the topologies avalaible for IPSEC and all of them are trought L3, the question is, in a link L2 is IPSEC topology supported?
Regards
EF
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
11-26-2021 05:23 AM
IPSEC is always over L3. MACSEC is over L2.
Here a possible setup
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
11-25-2021 03:49 AM
You should describe deeper your setup.
The IPSec tunnel+frag/defrag can be performed at the FIGW level while the isis logical interface is done at the switch level.
You should describe what you have today in a picture to be able to guide you.
Mig
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
11-25-2021 08:47 AM
I´ll try better, this is my working environment (VXLAN+FRAGMENTATION) , My deploy is L2 link with MTU less 1600 bytes between two FIGWs and it´s working fine:
Now I want to add IPSEC but I'm unable to add the necessary commands because there are exclusion with this config.
After my investigation I see that all topologies with IPSEC are over L3 networks,
so I begin to suspect that it´s not supported over L2 links.
It´s a question about topologies supported with FIGW and IPSEC.
BR
EF
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
11-26-2021 05:23 AM
IPSEC is always over L3. MACSEC is over L2.
Here a possible setup
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Get Direct Link
- Report Inappropriate Content
11-29-2021 09:48 AM
The FIGW would thus ARP for the remote end-points.
