Shared EG between services

To share a single EG between multiple services, ensure the following rules are not violated:

  1. The services must have the same peers.
  2. If the service is VPRN it must use the same protocol (SR-ISIS or SR-OSPF) and the same algorithm.

  3. The transport tunnel used for the services must be the same (if 1 and 2 are true, the same transport tunnel is used).

  4. If the service is VPRN, autobind and Layer 3 spoke-SDP interfaces can have the same EG or different EGs.

The following figure shows an example of two encrypted services using the same tunnel and EG.

Figure 1. Two encrypted services both using the same tunnel and EG

When the EG is shared between multiple services, only a single MKA session is established between the peers. Both services use that MKA session with its PSK to secure the SAK. The MKA session distributes the SAK between the peers, and both services are encrypted with the same SAK.