We have a client that is bringing in a MPLS router into our network. Right now they connect to our site using a tunnel between our two firewalls. I have a policy in place that locks them down to 4 specific servers (the servers have a gateway of 10.199.1.1 w/ a subnet of /24). Keep that in mind. Now, vendor configured the MPLS router w/ a gateway of 10.199.1.250. If I plug the router into our switch, I should be able to ping the MPLS router, no? So says the vendor.

Now, let's assume that's how it works. How the heck do I pass traffic from the 4 servers throguh the MPLS router? I'll have to kill the existing tunnel but the VLAN's gateway is 10.199.1.1 so that's what the servers are defaulted to. If traffic goes through the MPLS, how can I access those 4 boxes from my internal LAN then?

I hope it's not too late. For the first question - you should be able to ping the router. Then, you will pass the traffic the same you pass the traffic now, towards your main router. But, if you want only those four machines to route the data there, just create rules in respective firewall. If you have to kill the existing tunnel, you have to think of another way - new VLAN or new tunnel. I didn't understand, however, the big picture - why MPLS in the middle of the normal LAN ? You need to use MPLS paths and respective protocols to manage the traffic from the MPLS router.

thx for the reply, it's in the middle of our LAN due to the following reason.
This client has been connecting to these boxes via the tunnel we setup from our router to their router. So I can ping their subnet from the 4 boxes and they can ping our network/4 servers from their subnet. Their subnet is like 10.40.1.x or something.

They want to get rid of all these tunnels (they have over 15 offices, hence 15 tunnels were created from our site to their satellite offices). They brought in a MPLS setup so there's a router w/ 10.199.1.254 as the gateway sitting in my rack. Now we have to figure out how to route the 4 servers through this MPLS router and somehow for us to be able to connect to the box since we are fully responsible for them (os, hardware, app).