Showing results for 
Search instead for 
Did you mean: 

Ipsec dynamic map with certificate



i would like to do hub and spoke vpn setup.i already tested dynamic map with preshare key.

  1. let me know can we do dynamic map using certificate.let me know the sample config or reference link?
  2. do we have other way to create  multi ipsec tunnel on hub router without using dynamic map? i want to use pure ipsec.i caanot use gre or vti.



5 Replies 5

Rob Ingram
VIP Master VIP Master
VIP Master

Hi @MrBeginner 

You are using Cisco IOS router right? or ASA/FTD?


If using hub and spoke, the recommended approach would be FlexVPN or DMVPN, assuming you are using a cisco router. Cisco considers crypto maps as legacy. Most up to date cisco documentation for cisco IOS router VPNs, is based on FlexVPN and to a lesser extent DMVPN.


What certificate authority are you intending to use IOS router, Microsoft CA or?



FlexVPN certificate authentication

IOS Router certificate enrolment

Hi @Rob Ingram ,

I cannot use DMVPN Hub is cisco router and spoke are different brands. So i consider dynamic map.

i will use microsoft ca.

Let me know any issue on dynamic map with certificate ?

I also want to know ipsec tunnel can carry ospf route ?

@MrBeginner Ok, what are the other vendors used? You can't run a routing protocol over a crypto map without using GRE. If you cannot use a routing protocol over the VPN, you can use Reverse Route Injection (RRI) to learn the VPN routes for established tunnels and redistribute them locally via routing protocol.


Hi ,

I would like to know if i apply ipsec profile on WAN interface and soure is WAN IP and BGP neighbor relationship is also using WAN IP, it is any problem on encryption ? 


I assume you mean apply crypto map to the WAN interface? If so, then if the WAN interface IP address and the BGP peer is not defined in the crypto ACL (to define the interesting traffic) then the traffic would never match, nor attempted to be encrypted. It should therefore be fine.


Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers