Compare crypto maps with virtual tunnel interfaces. Which would you deploy today?
Show the answer
Say this first
A crypto map is policy-based: it is applied to the physical outside interface and an ACL decides which traffic is encrypted to which peer. A VTI is route-based: a tunnel interface with tunnel protection, and anything routed into it is encrypted. I would deploy VTIs. They run routing protocols, take per-tunnel QoS, ACLs and NAT, use one simple any-to-any selector, and show up in the routing table and interface counters like any link. Crypto maps stay for interop with peers that only do policy-based VPNs.
Go deeper
| Crypto map | Static VTI | |
|---|---|---|
| Model | policy-based | route-based |
| What gets encrypted | traffic matching the crypto ACL | traffic routed into the tunnel |
| Routing protocols | no (needs GRE) | yes |
| Selectors | one SA pair per ACL line | one pair, 0.0.0.0/0 both sides |
| Monitoring | SA counters | interface counters, SNMP, line protocol |
| Failover | several set peer entries plus DPD | routing over two tunnels |
Crypto map
crypto map VPNMAP 10 ipsec-isakmp
set peer 203.0.113.2
set transform-set TS-AES256
match address VPN-TRAFFIC
interface GigabitEthernet0/0/0
crypto map VPNMAPVTI
interface Tunnel0
ip address 172.16.12.1 255.255.255.252
tunnel source GigabitEthernet0/0/0
tunnel mode ipsec ipv4
tunnel destination 203.0.113.2
tunnel protection ipsec profile VTI-PROF
ip route 10.2.0.0 255.255.255.0 Tunnel0They will ask next
What is a dynamic VTI?
A hub-side template:
interface Virtual-Template1 type tunnelwith tunnel protection. Each peer that connects gets its own cloned Virtual-Access interface. It suits many spokes or remote access, and it is the base of FlexVPN.Your VTI must connect to a peer that only supports policy-based VPNs. What do you do?
The peer will propose specific subnets and my VTI expects any to any, so phase 2 fails. Either use a crypto map for that one peer, or get the peer to switch to a route-based tunnel with 0.0.0.0/0 selectors. Most current firewalls and cloud gateways support route-based mode.
Traps
- Building the VTI and forgetting the route. Nothing is encrypted until the remote prefixes point into the tunnel.