0

I need to connect to L2 networks over the internet, which means I'll need some form of security as well. The first obvious idea is IPSec, but what I'm not sure whether I need GRE over IPSec or simply IPSec? As far as I remember GRE is combined with IPSec because IPSec cannot handle multicast and non-IP messages. But VPLS can handle this, or am I wrong here?

Seathorn
  • 13
  • 3
  • 1
    VPLS requires a MPLS infrastructure. You can do GRE over IPSec. Depending on your needs, you should also look at VXLAN. – Ron Trunk Jun 29 '23 at 12:26
  • Some of the do's and dont's and caveats with L2-over-Internet were covered in https://networkengineering.stackexchange.com/questions/64505/vlans-over-internet/64510#64510 – Marc 'netztier' Luethi Jun 29 '23 at 13:16
  • Has any answer solved your question? Then please accept it or your question will keep popping up here forever. Please also consider voting for useful answers. – Zac67 Jul 29 '23 at 17:40

1 Answers1

0

As far as I remember GRE is combined with IPSec because IPSec cannot handle multicast and non-IP messages. But VPLS can handle this, or am I wrong here?

IPSec cannot handle MPLS labeled packets, so if MPLS needs to be IPSec encrypted, you'll need to add GRE in between (at the cost of another 24bytes of MTU). Lacking experience with VPLS, I could no say for certain, but chances are this restriction will very probably apply to VPLS, too. It's just MPLS-tagged Ethernet Frames instead of MPLS-Tagged IP packets, after all.

IPSec can handle multicast, in two ways: a) by adding GRE or b) if you run it with "real" tunnels ("sVTI/dVTI", "routed mode", "interface mode"; the terms vary by vendor). In either mode, you can even have a PIM neighborship through an IPSec tunnel between to PIM routers, and you can run dynamic routing protocols through such a tunnel (OSPF, EIGRP, RIP), even if they base their neighbor discovery on multicast.

That being said, L2 extension over a routed network not under your own full control is not for the faint of heart. You really need to know what you're doing.

Marc 'netztier' Luethi
  • 8,836
  • 1
  • 14
  • 30