[Contents]
[Prev]
[Next]
[Index]
[Report an Error]
Service Sets
The Adaptive Services PIC supports two types of
service sets when you configure IPSec tunnels. Because they are used
for different purposes, it is important to know the differences between
these service set types.
- Next-hop service set—Supports multicast and multicast-style
dynamic routing protocols (such as OSPF) over IPSec. Next-hop service
sets allow you to use inside and outside logical interfaces on the Adaptive Services PIC to connect with
multiple routing instances. They also allow the use of Network Address
Translation (NAT) and stateful firewall capabilities. However, next-hop
service sets do not monitor Routing Engine traffic by default and
require configuration of multiple service sets to support traffic
from multiple interfaces.
- Interface service set—Applied to a physical interface
and similar to a stateless firewall filter. They are easy to configure,
can support traffic from multiple interfaces, and can monitor Routing
Engine traffic by default. However, they cannot support dynamic routing
protocols or multicast traffic over the IPSec tunnel.
In general, we recommend that you use next-hop
service sets because they support routing protocols and multicast
over the IPSec tunnel, they are easier to understand, and the routing
table makes forwarding decisions without administrative intervention.
[Contents]
[Prev]
[Next]
[Index]
[Report an Error]
