Hi,
there is an IKEv2 IPSec tunnel using VTI between router and ASA. All works well. Now, the device which create IPSec to the same ASA (using dynamic crypto map on the ASA) is connected to the LAN behind this router. The VTI IPSec works but crypto map IPSec doesn't. In the show crypto ipsec sa peer <ip address> I can see the following for the VTI IPsec in use settings ={L2L, Tunnel, PFS Group 24, IKEv2, VTI, } and in use settings ={L2L, Tunnel, NAT-T-Encaps, PFS Group 24, IKEv2, VTI, } for the dynamic crypto map IPSec (notice the VTI for both of them which is not correct). When I shut down the VTI and clear the session, the crypto map IPSec starts to work because it doesn't use VTI anymore: in use settings ={L2L, Tunnel, NAT-T-Encaps, PFS Group 5, IKEv2, }. Then I enable VTI and it works as well. But this is only temporary solution. Is there anything fix this? I can't use the VTI tunnel for all traffic towards ASA. Two tunnels are needed.
thank you
