On Tue, 2010-03-09 at 13:35 +0100, Peter Rathlev wrote: > And the encrypted traffic leaves the box tagged too.
I assumed a little too much here. :-) It turns out that the traffic leaves the box unencrypted unless it originated on the box itself. So ping inside the tunnel interface works fine, but traffic arriving from outside the box only gets GRE encapsulated, not IPSec. MPLS always comes on top. I ended up having to use a non-MPLS interface as the "outside" interface to make the box actually encrypt things. I thought I could pull this off on a 7200. They're so versatile. :-) -- Peter _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
