[c-nsp] OPSF over a Lan-to-Lan VPN tunnel

Per A erpa22276 at yahoo.com
Mon Dec 15 19:41:03 EST 2008

This is an exersize in learning, and I'm getting stuck on the OSPF/Routing piece.
What I am wanting to do is build a Lan-to-Lan VPN network between a 2811 and a 3005.  Once that is done, inner routers at each site will run OSPF/Routing Protocol and should populate routes between the sites.
I have built the VPN Lan-to-Lan sucessfully, but I am not able to get the Inner Routers to build neighbor relationships. Likely, I am missing something fundamental.
The outer/gateway/vpn devices at each site (2800 and 3005) are not participating in OSPF.  I have configured the near and far side networks on each VPN device and have full connectivity between all clients at both sites.  My challenge is to get the gateway devices to forward the OSPF Multicasts to the far side network and delivered to the Inner Router.
I understand that the Neighbor Relationship is built with Hello Messages between routers that share a common segment.  I assumed that the VPN tunnel between sites would simulate this "common segment" function by identifying the multicast traffic as "interesting" and thus forward the multicast to the far end.  To get to this, I used an access list to identify the source networks and then identified the destination as, thinking that the local VPN device would see the multicast communication from the Inner Router and encapsulate it for passage to the far end.  Once arriving, the far end would un-encapsulate it and deliver it to the inside interface where the far end Inner Router would recieve the multicast Hello message.
Here is what the network looks like:
So my assumption is that this is not working because the two Inner Routers do not share the "common segment" which likely requires identical subnet/mask.  
Is there any way to make this kind of environment work, or possibly an alternative solution where the Outer/VPN devices do not participate in the Routing Protocol but the Inner Routers do?
Thanks for any assistance you can offer.


More information about the cisco-nsp mailing list