topic Re: Static route throug dynamic vti in Network Security

Static route throug dynamic vti

andre.baumgarten — Fri, 31 Jan 2025 07:33:37 GMT

Hello Community,

i want to build a Hub-Spoke Topology with dynamic VTIs. The final design is using BGP which is working perfectly. For testing i wanted to set a static route from HUB (with dyn vti) to Spoke. But i cannot select the dyn VTIinterface in the routing GUI. The interface is there and it is shown on cli. BGP is also working, i only cannot select it for static routing. Is it a bug or a feature ;-)?

thx for feedback.

Andre

Re: Static route throug dynamic vti

M02@rt37 — Fri, 31 Jan 2025 08:26:21 GMT

Hello @andre.baumgarten

Tunnels are dynamically created when traffic flows, making them unsuitable for static routing in the GUI...

So, from my point of vieuw, this is not a bug but rather a limitation of how dynamic VTIs work. If your final design is already using BGP and working well, I’d recommend sticking with BGP instead of trying to force static routing in a scenario that isn't designed for it.

Re: Static route throug dynamic vti

MHM Cisco World — Fri, 31 Jan 2025 10:03:36 GMT

Let me check this

Thanks for waiting

MHM

Re: Static route throug dynamic vti

Sheraz.Salim — Fri, 31 Jan 2025 09:28:57 GMT

Dynamic Virtual Tunnel Interfaces (VTIs) are designed to work with dynamic routing protocols like BGP, rather than static routes. In a Hub-Spoke topology with dynamic VTIs, the inability to select the dynamic VTI interface for static routing in the GUI is likely by design, not a bug.

Dynamic VTIs are created on-demand and are not persistent interfaces. This makes them unsuitable for static routing, which requires a stable, always-present interface, The hub uses a virtual template for dynamic instantiation of IPsec interfaces. Each VPN session generates a unique virtual access interface, making it impractical to configure static routes for these temporary interfaces. Here is the link

If you need to test connectivity without using BGP, consider these options.

Use IKEv2 to push routes: Configure the route set interface command in your IKEv2 authorization policy to advertise routes over the VTI Here and Here
Use a loopback interface: Create a loopback interface with the IP address you want to use for the tunnel, then use ip unnumbered on the virtual template to borrow this IP. You might be able to create a static route to this loopback Here

For testing purposes only, you could configure a static VTI on the hub instead of a dynamic VTI, which would allow you to set static routes Here