Crypto Map-based IPSec VPN

[omz]

Hi all

Can someone please explain thy below statement with the help of an example?

This is one of the scalability limitations of Crypto Map-based configurations; the number of SAs does not scale linearly with the number of tunnel endpoints, as it would in either a GRE over IPsec or IPsec VTI configuration.

Thank you

[Dennis Mink]

My take on this is, if you have an IPSEC tunnel between two tunnel endpoints (public IP addresses),

you can have an X number of unidirectional SA's as per below pic. Depending on how complicated your protected traffic definitions are

[Rob Ingram]

When using a Crypto Map VPN, regardless of how many interesting networks defined in the ACL there will be 2 (uni-directional) x IPSec SA.

However using a GRE tunnel or VTI there will only ever be 2 x IPSec SA per peer/tunnel endpoint, thus making a GRE/VTI more scalable than Crypto Map.

HTH