Using a static VTI on a SR520 to RV110w IPsec VPN

[craigzuehlke]

I am trying to set up a static VTI IPsec VPN between a SR520 and a RV110w. This works fine between the 520 and an 861, but the RV110 complains about the "permit ip any any" default policy of the VTI. (Same thing happens with the 861 and rv110) Does anyone know how to put a policy in place that would be used in negotiating the tunnel that the 110 would accept?

Attached the lines out of the 110's log and the VTI setup.

Thanks in advance!

[Javier Portuguez]

Craig,

I have checking around and I think the RV110w does not support VTI.

I would suggest using a crypto map on the SR520, in case you need to send Multicast traffic across a VPN tunnel you may consider replacing the RV110 with a more sophisticated device.

Thanks.

Portu.

Please rate any helpful posts

[craigzuehlke]

Thanks Portu. If it's that the 110 doesn't have VTIs, that's true. If it's that there's no way to get past the VTI's default policy, that's what I need to know.

Craig

[Javier Portuguez]

Craig,

Thanks for your response.

Let me ask a couple of question.

Why do you need a VTI tunnel (for Multicast maybe) ?

Have considered using a crypto map instead?

Thanks.

Portu.

[craigzuehlke]

Sorry to reply late. Yes, mutlicast is one thing needed. The crypto maps are the "regular" way of setting up VPNs, but the tunnels offer a native way of doing it. Just requires an open (but encrypted) tunnel, which the 110s don't support. By having a tunnel interface, you can more easily manage thing like routing, security, qos, etc., not to mention it's easy to shut down an interface. I didn't find that you can assign the maps to loopback interfaces, which gives some of the features, but still not native like a VTI. If you know how to apply a policy to a VTI, thanks much! Otherwise, I'll just use the maps applied to wan interface.

Thanx,

Craig

[Javier Portuguez]

Hi Craig,

Thanks for your clarification.

Since the 110 does not support VTI then we will have to work with a "crypto map".

If you need VTI, then you may want to consider a more powerful device like an 800 Router series for instance.

Thanks.

Portu.

Please rate any helpfuls posts