cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
248
Views
0
Helpful
4
Replies
Highlighted

VPN Tunnel IKEV2

Hi All,

 

Whether we can use the crytomap in IKEV2? I heard the cryptomap is an older one and it is the version of IKEV1. But in one of the IKEV2 config they called the cryptomap instead of tunnel interface? Kindly correct me and explain the theory.

 

Thanks.

2 ACCEPTED SOLUTIONS

Accepted Solutions
Highlighted
VIP Advisor

Re: VPN Tunnel IKEV2

Hi,
You can still implement IKEv2 crypto maps. Crypto Map and VTI (tunnel interfaces) are completely different way to configure a VPN. A crypto map configuration uses an ACL to define interesting traffic, this configuration is static and would require modification when adding additional networks.

When using a VTI this does not use an ACL to define interesting traffic, this just requires a route (either a static route or a route learnt dynamically via a routing protocol). VTI's VPN are simplier to management and much more scalable, requiring less IPSec SAs than a crypto map, therefore less resources.

Crypto Maps are considered legacy by Cisco and the recommendation is to use VTI.

Examples of Tunnel Interface VPNs are FlexVPN/DMVPN

HTH

View solution in original post

Highlighted
VIP Advisor

Re: VPN Tunnel IKEV2

Yes that would work, or advertise the networks using a routing protocol and then you would not need to manually configure the routes. Remember the 23.0.0.0 networks needs a route back over the VPN to the source network.

HTH

View solution in original post

4 REPLIES 4
Highlighted
VIP Advisor

Re: VPN Tunnel IKEV2

Hi,
You can still implement IKEv2 crypto maps. Crypto Map and VTI (tunnel interfaces) are completely different way to configure a VPN. A crypto map configuration uses an ACL to define interesting traffic, this configuration is static and would require modification when adding additional networks.

When using a VTI this does not use an ACL to define interesting traffic, this just requires a route (either a static route or a route learnt dynamically via a routing protocol). VTI's VPN are simplier to management and much more scalable, requiring less IPSec SAs than a crypto map, therefore less resources.

Crypto Maps are considered legacy by Cisco and the recommendation is to use VTI.

Examples of Tunnel Interface VPNs are FlexVPN/DMVPN

HTH

View solution in original post

Highlighted

Re: VPN Tunnel IKEV2

Thanks for the response. Kindly correct me if I am wrong for the below:

For VTI:
Consider if I need to access the destination 23.0.0.7 through tunnel0, then whether the configuration below is correct?
ip route 23.0.0.7 255.0.0.0 tunnel0.
In future if i have to access another new destination, then simply I can point the static route to tunnel. Please correct me if I am wrong.

Thanks.
Highlighted
VIP Advisor

Re: VPN Tunnel IKEV2

Yes that would work, or advertise the networks using a routing protocol and then you would not need to manually configure the routes. Remember the 23.0.0.0 networks needs a route back over the VPN to the source network.

HTH

View solution in original post

Highlighted

Re: VPN Tunnel IKEV2

Thanks for the reply