VRF lite and VTI IPSEC tunnels

Started by Dieselboy, February 09, 2015, 08:23:11 PM

Previous topic - Next topic
Print
Go Down Pages1
User actions

Dieselboy

February 09, 2015, 08:23:11 PM Last Edit: February 09, 2015, 08:29:21 PM by Dieselboy
A 2900 series router has 3 interfaces.
gi0/0 connects to the internet.
gi0/1 connects to the inside network
gi0/2 connects to the ASA firewalls

The 2900 router routes out to the internet in front of the ASAs. It also is a voice gateway, hence the gi0/1 on the inside network. It also does IPSEC VPN using VTI tunnels (there's also a backup DSL on dialer 0).

I have 2 VRFs, the global and VRF2 (not really the real name) VRF2 which is configured onto gi0/2.

The way I have routing is inside network route to the inside of the ASA. ASA default route to 2900 gi0/2. VRF2 default route to the global routing table which is upstream of gi0/0.

I want the interface of gi0/1 to have a default route of the ASAs so SIP traffic goes that way. But I don't want to break SIP or anything else. So, I'm thinking of placing the interface gi0/0 into VRF2 so that only internet traffic is separated from everything else. However I still need the VTI VPNs to come in on gi0/0.

So:
Will the VTI's still work if I place gi0/0 in a different VRF but have the "interface tunnel x" in the global route table?

Another reason I am thinking of doing it this way is I think I read a while ago that I could break the voice services of the 2900 if I put gi0/1 into a VRF.
Print
Go Up Pages1
User actions