For context:

887 router is connected to a 4G modem through a L2 physical interface (switchport access vlan 3) – It has 4 L2 ports only.

Vlan 3 SVI ip address = 10.212.6.239/24

4G public IP has been used to create a tunnel directly to one of our corporate sites, configuration for the VPN has been done on both sides, this includes matching crypto keys (isakmp), ospf networking statements and source/destination IPs. Our source, on the 4G side, for the tunnel is 10.212.6.239 (int vlan 3) which is within the same subnet as the 4G box interface – VLAN 3 is an SVI created to provide L3 connectivity to clients, as L2 interfaces cannot be assigned IP addresses

TRAFFIC FLOW

DHCP has been configured on the 887 to hand out ip addresses in the 172.16.152.0/24 network. with a default-router statment for 172.16.152.254 which is the IP address for int VLAN 1.

So clients connected to the 887 are within the 172.16.152.0/24 subnet. What I failed to understand is, is how we get clients in 172.16.152.0/24 OUT of vlan 1 and into vlan 3 to then be routed to the corporate network over the tunnel.

I think this confusion was because the ports are L2 so I was thinking more in sense of L2 switching, where you cannot hop vlans – as that requires routing (L3). But in this case we are using an 887 which is fully capable of ROUTING and is able to route vlans between eachother.

So traffic comes in on vlan 1 destined for the corporate network over the tunnel (say 172.31.0.0/16), it hits its default gateway (VLAN 1 SVI). 887 looks in its routing table looking for entries for 172.31.0.0/16.

The route above was advertised via OSPF over the tunnel. Its next hop is 10.230.152.1 (the tunnel interface). Traffic then gets sent out that tunnel interface and hits the other end (10.230.152.2). Then the corporate firewall on the other end routes traffic to its destination through its own routing table.

Bare in mind – Config has to be done on both sides particularly with the VPN configuration and access control – the firewall natively blocks traffic, so it requires permit statements for both the tunnel and the 172.16.152.0/24 network.

Access control on the 4G side (887 config):

Show ip route: