Answer Only on VPN Tunnel

[Joe Lee]

Hello everyone,

I want to terminate the IP Sec VPN tunnel on the Cisco ASR 1002 router, but it shouldn't have be bedirectional traffic to the other end., and it should be answer only, We don't run tunnle over GRE (no IPSec profile), just IPSec only. I found there is a command "crypto map *** client configuration address respond" but it looks it is global command and we have lots of VPN terminated on the Cisco ASR 1002 router, How can we configure the "Answer Only" for only one specific VPN tunnel and it won't impact the others? Please advise.

Regards,

Joe

[rizwanr74]

A Router to be configured as a Responder-Only device in a crypto negotiation

Cisco IOS Software Release 12.4(24)T introduces the functionality of the router to always respond to the IKE negotiations initiated by its peers. The main limitation is that this feature is configurable only under an IPSec profile and is relevant only to a virtual interface scenario. No support for static or dynamic crypto map scenarios.

In order to configure your router as responder-only, perform these steps:

enable 
configure terminal 
crypto ipsec profile  
  responder-only

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080b8ad03.shtml#routerrespond

thanks

Rizwan Rafeek

[Joe Lee]

Thank you Rizwan. please correct me if I am wrong, ipsec profile is for the VTI, and we only run static crypto map. So in our scenarios it won't work.