VPN Tunnel IKEV2

[SathishkumarSaravanan0348]

Hi All,

Whether we can use the crytomap in IKEV2? I heard the cryptomap is an older one and it is the version of IKEV1. But in one of the IKEV2 config they called the cryptomap instead of tunnel interface? Kindly correct me and explain the theory.

Thanks.

[Rob Ingram · Accepted solution]

Hi,
You can still implement IKEv2 crypto maps. Crypto Map and VTI (tunnel interfaces) are completely different way to configure a VPN. A crypto map configuration uses an ACL to define interesting traffic, this configuration is static and would require modification when adding additional networks.

When using a VTI this does not use an ACL to define interesting traffic, this just requires a route (either a static route or a route learnt dynamically via a routing protocol). VTI's VPN are simplier to management and much more scalable, requiring less IPSec SAs than a crypto map, therefore less resources.

Crypto Maps are considered legacy by Cisco and the recommendation is to use VTI.

Examples of Tunnel Interface VPNs are FlexVPN/DMVPN

HTH

[SathishkumarSaravanan0348]

Thanks for the response. Kindly correct me if I am wrong for the below:

For VTI:
Consider if I need to access the destination 23.0.0.7 through tunnel0, then whether the configuration below is correct?
ip route 23.0.0.7 255.0.0.0 tunnel0.
In future if i have to access another new destination, then simply I can point the static route to tunnel. Please correct me if I am wrong.

Thanks.

[Rob Ingram · Accepted solution]

Yes that would work, or advertise the networks using a routing protocol and then you would not need to manually configure the routes. Remember the 23.0.0.0 networks needs a route back over the VPN to the source network.

HTH

[SathishkumarSaravanan0348]

Thanks for the reply