let's say we have 30ish routing instances that may or may not need to be extended to 30ish remote sites. currently that is done via mpls. (or one gre tunnel per instances...)
I'm proposing doing a split tunnel at the remote side, an ipsec tunnel back to central, and doing pbf on the same vsys where the ipsec tunnels land. it would require one pbf rule per routing instance we want to extend (and each instance gets its own /16 to keep the rules simple). the goal is that new remote site deployments only require one ipsec tunnel, one bgp peer, and then layer3 interfaces for any routing instances required. I want this dead simple for folks to deploy.
EmZaid 🫥
npub1vk…hjy73
2026-10-26 18:27:28 UTC
in reply to nevent1q…3atm
Author Public Key
npub1vk8lr3te0jmmup6n0ugw9vl0ay6mfc25z947gwn7ak40ux3m428sahjy73Seen on
wss://relay.momostr.pinkPublished at
2026-10-26 18:27:28 UTCEvent JSON
{
"id": "37f616ea1002bb648b30a67710a3a6588a8df8491c0ab811c92dc6912804d05f",
"pubkey": "658ff1c5797cb7be07537f10e2b3efe935b4e154116be43a7eedaafe1a3baa8f",
"created_at": 1793039248,
"kind": 1,
"tags": [
[
"p",
"d4ddbab088ccccce697a3a93799c7ae3ed1d684755faa799b8ae46a3563da069"
],
[
"e",
"c3152c7e602f884290e7f8e7694a4f8e33215acc1da7ffdaaf3baac2bcc1d54e",
"",
"reply",
"accb895bb24c81dba9ba44071cc135ee0d6d2b98f3e2938f0993dbdfb6c29356"
],
[
"p",
"86b397086a130510861dd58f255fadeee1c47815185fa3bb628a06b4d6af31ac"
],
[
"p",
"accb895bb24c81dba9ba44071cc135ee0d6d2b98f3e2938f0993dbdfb6c29356"
],
[
"p",
"658ff1c5797cb7be07537f10e2b3efe935b4e154116be43a7eedaafe1a3baa8f"
],
[
"p",
"beafe3d7b24a5d649a7321d3e43e882337f2b2b4bbc771816f66859481a9b911"
],
[
"e",
"f144b827736ba88929b980f5195ab5d78019e1a5c8954dd1775d0ce0b3495c13",
"",
"root",
"658ff1c5797cb7be07537f10e2b3efe935b4e154116be43a7eedaafe1a3baa8f"
],
[
"proxy",
"https://infosec.exchange/@EmZaid/117508620164514140",
"web"
],
[
"proxy",
"https://infosec.exchange/users/EmZaid/statuses/117508620164514140",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/EmZaid/statuses/117508620164514140",
"pink.momostr"
],
[
"-"
]
],
"content": "let's say we have 30ish routing instances that may or may not need to be extended to 30ish remote sites. currently that is done via mpls. (or one gre tunnel per instances...)\n\nI'm proposing doing a split tunnel at the remote side, an ipsec tunnel back to central, and doing pbf on the same vsys where the ipsec tunnels land. it would require one pbf rule per routing instance we want to extend (and each instance gets its own /16 to keep the rules simple). the goal is that new remote site deployments only require one ipsec tunnel, one bgp peer, and then layer3 interfaces for any routing instances required. I want this dead simple for folks to deploy.",
"sig": "d384161f221c7f92aafcb42f539e9edef19c4449157da968b993fd57a2d0cbc7ab67eeea3818374436e46e0c50fa73adb45f85986151551d03dbd4019ee3e5c1"
}