In your diagram, the 元 switch and the right-hand router need to know the route to 'Remote Device'. Set up static routes or use a routing protocol like OSPF. Routing needs to be consistent, so that all routers on each tunnel side know where to route all subnets. If that isn't the case you either need to use other means of user identification or multiple tunnels for the various trust zones. you can be sure that the source IP has not been spoofed. Of course, that implies that you trust the far tunnel endpoint, ie. The destination address is the 元 subnet, located in a VLAN.įor security, you filter by combination of source address and destination subnet (or address) between the tunnel and the inter-VLAN router. VPN is (usually) 元, so you route into the VLANs from the VPN tunnel endpoint (and vice versa, for simplicity I'm referring to the in direction only).
VLANs are only useful within a shared L2 infrastructure.
