can i use a vti at one end and crypto map at the other?

[Mike Schooley]

both gre thru ipsec correct?

[Alain Jourez]

Hello Mike,

Just for clarity reason, let me redefine things a bit. VTI stands for virtual tunnel interface. This is a Tunnel with both "tunnel mode ipsec ipv4" _and_ "tunnel protection ipsec profile ".

Given this, then this is incompatible with crypto-maps this far, as a VTI will always negotiate "permit ip any any", which is incompatible with crypto-maps on the other end, which require a more specific access-list for intersting traffic.

Now considering just tunnel protection, with a tunnel mode set to GRE (default), there you can terminate the VPN on another box that is using crypto maps. Indeed the ipsec negotiation will request in this situation a "permit gre host host " which can be reflected in the access-list used by the crypto map.

I hope this answers your question.

Thanks

Alain

[Mike Schooley]

ok so if I dont use the tunnel mode ipsec portion, it automatically creates an encryption domain of the tunnel endpoints?  Also now if i do use tunnel mode ipsec, it is an ipsec tunnell without gre, but still supports multicast so can run eigrp, ospf, etc over it correct.

[Alain Jourez]

Hi Mike,

When you add tunnel "protection ipsec profile", this will indeed create the entry in the security policy database to encrypt the tunnel itself. The generated crypto map will actually match either GRE between the endpoints (when in the default tunnel mode gre ip) or ip any any in the case of pure vti (tunnel mode ipsec ipv4).

And yes, in both cases you will be able to pass routing protocol over them.

HTH.

Alain

[kviliussimas]

In general tunnel interface can be configured to work with cryptomap configuration on other end of the tunnel. To do it, you need to manually configure proxy id on the VTI tunnel side which mirrors proxy id configured on the cryptomap. For example Juniper SSG devices have this feature. Unfortunately on Cisco IOS there are no way to manually set proxy id and it always usesip any any, so this configuration isn't possible between two Cisco IOS routers.

[ggmeza1983]

Hi to All, i have an scenario where i'm running dmvpn with vti. I need to connect to other site which uses mikrotik. As I read, mikrotik doesn´t support vti. So can i configure site to site between the router cisco and mikrotik with crypto map on my side? I don´t wanto to affect the dmvpn operation. any suggestions?

[Rob Ingram]

@ggmeza1983 I'm pretty sure running a crypto map and a vti on the same interface is not supported.

If you have further questions please create a new post rather than respond to an 11 year old post.