IPsec Virtual Tunnel Interface

IPsec VTIs allow you to configure a virtual interface to which you can apply features. Features for clear-text packets are configured on the VTI. Features for encrypted packets are applied on the physical outside interface. When IPsec VTIs are used, you can separate the application of features such as NAT, ACLs, and QoS and apply them to clear-text or encrypted text, or both. When crypto maps are used, there is no simple way to apply extra features to the IPsec tunnel.

There are two types of VTI interfaces: static VTIs (SVTIs) and dynamic VTIs (DVTIs).

SVTI configurations can be used for site-to-site connectivity in which a tunnel provides always-on access between two sites. The advantage of using SVTIs as opposed to crypto map configurations is that users can enable dynamic routing protocols on the tunnel interface without the extra 24 bytes required for GRE headers, thus reducing the bandwidth for sending encrypted data.

Additionally, multiple Cisco IOS XE software features can be configured directly on the tunnel interface and on the physical egress interface of the tunnel interface. This direct configuration allows users to have solid control on the application of the features in the pre- or post-encryption path.

The figure below illustrates how a SVTI is used.

The IPsec VTI supports native IPsec tunneling and exhibits most of the properties of a physical interface.

DVTIs can provide highly secure and scalable connectivity for remote-access VPNs. The DVTI technology replaces dynamic crypto maps and the dynamic hub-and-spoke method for establishing tunnels.

DVTIs can be used for both the server and remote configuration. The tunnels provide an on-demand separate virtual access interface for each VPN session. The configuration of the virtual access interfaces is cloned from a virtual template configuration, which includes the IPsec configuration and any Cisco IOS XE software feature configured on the virtual template interface, such as QoS, NetFlow, or ACLs.

Because DVTIs function like any other real interface, you can apply QoS, firewall, and other security services as soon as the tunnel is active. QoS features can be used to improve the performance of various applications across the network. Any combination of QoS features offered in Cisco IOS XE software can be used to support voice, video, or data applications.

DVTIs provide efficiency in the use of IP addresses and provide secure connectivity. DVTIs allow dynamically downloadable per-group and per-user policies to be configured on a RADIUS server. The per-group or per-user definition can be created using extended authentication (Xauth) User or Unity groups or it can be derived from a certificate. DVTIs are standards based, so interoperability in a multiple-vendor environment is supported. IPsec DVTIs allow you to create highly secure connectivity for remote access VPNs and can be combined with Cisco Architecture for Voice, Video, and Integrated Data (AVVID) to deliver converged voice, video, and data over IP networks. The DVTI simplifies VPN routing and forwarding (VRF)-aware IPsec deployment. The VRF is configured on the interface.

A DVTI requires minimal configuration on the router. A single virtual template can be configured and cloned.

The DVTI creates an interface for IPsec sessions and uses the virtual template infrastructure for dynamic instantiation and management of dynamic IPsec VTIs. The virtual template infrastructure is extended to create dynamic virtual-access tunnel interfaces. DVTIs are used in hub-and-spoke configurations. A single DVTI can support several static VTIs.

Note	DVTI is supported in Easy VPNs. That is, the DVTI end must be configured as an Easy VPN server. DVTI can also be used in site-to-site scenarios.

The figure below illustrates the DVTI authentication path.

The authentication shown in the figure above follows this path:

1. User 1 calls the router.
2. Router 1 authenticates User 1.
3. IPsec clones the virtual access interface from the virtual template interface.

The figure below illustrates the DVTI authentication path in a site-to-site scenario.

DVTI supports multiple IPsec SAs. The DVTI can accept multiple IPsec selectors that are proposed by the initiator.

The DVTIs allow per-peer features to be applied on a dedicated interface. You can order features in such way that all features that are applied on the virtual access interfaces are applied before applying crypto. Additionally, all the features that are applied on the physical interfaces are applied after applying crypto. Clean routing is available across all VRFs so that there are no traffic leaks from one VRF to another before encrypting.

Multi-SA VTIs ensure interoperation with third-party devices and provide a flexible, clean, and modular feature-set.

Multi-SA VTIs enable a clean Cisco IOS XE infrastructure, even when the Cisco IOS XE software interoperates with the third-party devices that only implement crypto maps.

VRF and Scalability of Baseline Configuration:

Virtual access instances inherit the Inside-VRF (IVRF) from the template configuration. Users must configure several templates to enforce an appropriate IVRF for each customer. The number of templates must be equal to the number of customers connecting to the headend. Such a configuration is cumbersome and undesirable and also affects performance because each template declaration consumes one Interface Descriptor Block (IDB).

This complication can be avoided by allowing the IKE profile to override the virtual access VRF with the VRF configured on the IKE profile. A better solution is to allow the IKE profile to override the virtual access VRF using AAA, but this method is supported only for IKEv2.

The VRF configured in the ISAKMP profile is applied to the virtual access first. Then the configuration from virtual template is applied to the virtual access. If your virtual template contains ip vrf forwarding command configuration, the VRF from the template overrides the VRF from the ISAKMP profile.

Rules for Initial Configuration of a VRF:

The following rules must be applied during the initial configuration of VRF:

• If you configure IVRF in the IKE profile without configuring it in the virtual template, then you must apply the VRF from the IKE profile on each virtual access derived from this IKE profile.
• If you configure VRF in an IKE profile and virtual template, then the virtual template IVRF gets precedence.

Rules for Changing the VRF:

If you change the VRF configured in an IKE profile, all the IKE SAs, IPsec SAs, and the virtual access identifier derived from this profile will get deleted. The same rule applies when the VRF is configured on the IKE profile for the first time.

IPsec profiles define policy for DVTIs. The dynamic interface is created at the end of IKE Phase 1 and IKE Phase 1.5. The interface is deleted when the IPsec session to the peer is closed. The IPsec session is closed when both IKE and IPsec SAs to the peer are deleted.

Because VTIs are routable interfaces, routing plays an important role in the encryption process. Traffic is encrypted only if it is forwarded out of the VTI, and traffic arriving on the VTI is decrypted and routed accordingly. VTIs allow you to establish an encryption tunnel using a real interface as the tunnel endpoint. You can route to the interface or apply services such as QoS, firewalls, network address translation, and NetFlow statistics as you would to any other interface. You can monitor the interface and route to it, and it has an advantage over crypto maps because it is a real interface and provides the benefits of any other Cisco IOS XE interface.

When an IPsec VTI is configured, encryption occurs in the tunnel. Traffic is encrypted when it is forwarded to the tunnel interface. Traffic forwarding is handled by the IP routing table, and dynamic or static routing can be used to route traffic to the SVTI. DVTI uses reverse route injection to further simplify the routing configurations. Using IP routing to forward the traffic to encryption simplifies the IPsec VPN configuration because the use of ACLs with a crypto map in native IPsec configurations is not required. The IPsec virtual tunnel also allows you to encrypt multicast traffic with IPsec.

IPsec packet flow into the IPsec tunnel is illustrated in the figure below.

After packets arrive on the inside interface, the forwarding engine switches the packets to the VTI, where they are encrypted. The encrypted packets are handed back to the forwarding engine, where they are switched through the outside interface.

The figure below shows the packet flow out of the IPsec tunnel.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    crypto ipsec profile profile-name

4.    set transform-set transform-set-name [transform-set-name2...transform-set-name6]

5.    exit

6.    interface type number

7.    ip address address mask

8.    tunnel mode ipsec ipv4

9.    tunnel source type number

10.    tunnel destination ip-address

11.    tunnel protection ipsec profile profile-name [shared]

12.    exit

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	crypto ipsec profile profile-name Example: Router(config)# crypto ipsec profile PROF	Defines the IPsec parameters that are to be used for IPsec encryption between two IPsec routers.
Step 4	set transform-set transform-set-name [transform-set-name2...transform-set-name6] Example: Router(config)# set transform-set tset	Specifies which transform sets can be used with the IPsec profile.
Step 5	exit Example: Router(config)# exit	Exits IPsec profile configuration mode.
Step 6	interface type number Example: Router(config-if)# interface tunnel 0	Specifies the interface on which the tunnel is configured and enters interface configuration mode. .
Step 7	ip address address mask Example: Router(config-if)# ip address 10.1.1.1 255.255.255.0	Specifies the IP address and mask.
Step 8	tunnel mode ipsec ipv4 Example: Router(config-if)# tunnel mode ipsec ipv4	Defines the mode for the tunnel.
Step 9	tunnel source type number Example: Router(config-if)# tunnel source ethernet 0/0	Specifies the tunnel source as an IP-enabled interface.
Step 10	tunnel destination ip-address Example: Router(config-if)# tunnel destination 172.16.1.1	Identifies the IP address of the tunnel destination.
Step 11	tunnel protection ipsec profile profile-name [shared] Example: Router(config-if)# tunnel protection ipsec profile PROF	Associates a tunnel interface with an IPsec profile.
Step 12	exit Example: Router(config-if)# end	Exits interface configuration mode and returns to privileged EXEC mode.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    crypto ipsec profile name

4.    set transform-set transform-set-name [transform-set-name2...transform-set-name6]

5.    exit

6.    interface virtual-template number

7.    tunnel mode ipsec ipv4

8.    tunnel protection ipsec profile name [shared]

9.    exit

10.    crypto isakmp profile name

11.    match identity address ip-address mask

12.    virtual-template template-number

13.    end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	crypto ipsec profile name Example: Router(config)# crypto ipsec profile PROF	Defines the IPsec parameters that are to be used for IPsec encryption between two IPsec routers and enters IPsec profile configuration mode.
Step 4	set transform-set transform-set-name [transform-set-name2...transform-set-name6] Example: Router(ipsec-profile)# set transform-set tset	Specifies which transform sets can be used with the IPSec profile.
Step 5	exit Example: Router(ipsec-profile)# exit	Exits IPsec profile configuration mode and enters global configuration mode.
Step 6	interface virtual-template number Example: Router(config)# interface virtual-template 2	Defines a virtual-template tunnel interface and enters interface configuration mode.
Step 7	tunnel mode ipsec ipv4 Example: Router(config-if)# tunnel mode ipsec ipv4	Defines the mode for the tunnel.
Step 8	tunnel protection ipsec profile name [shared] Example: Router(config-if)# tunnel protection ipsec profile PROF	Associates a tunnel interface with an IPsec profile.
Step 9	exit Example: Router(config-if)# exit	Exits interface configuration mode.
Step 10	crypto isakmp profile name Example: Router(config)# crypto isakmp profile profile1	Defines the ISAKMP profile to be used for the virtual template and enters isakmp-profile configuration mode.
Step 11	match identity address ip-address mask Example: Router(config-isa-prof)# match identity address 10.1.1.0 255.255.255.0	Matches an identity from the ISAKMP profile to be used for the virtual template.
Step 12	virtual-template template-number Example: Router(config-isa-prof)# virtual-template 1	Specifies the virtual template attached to the ISAKMP profile.
Step 13	end Example: Router(config-isa-prof)# end	Exits isakmp-profile configuration mode and enters privileged EXEC mode.

SUMMARY STEPS

1.    enable

2.   configure terminal

3.   ip vrf vrf-name

4.   rd route-distinguisher

5.   exit

6.   crypto keyring keyring-name

7.    pre-shared-key address key key

8.   exit

9.   crypto isakmp profile profile-name

10.    keyring keyring-name

11.    match identity address mask

12.    virtual-template template-number

13.    exit

14.    crypto ipsec transform-set transform-set-name transform1 [transform2] [transform3]

15.    exit

16.    crypto ipsec profile name

17.    set security-policy limit maximum-limit

18.    set transform-set transform-set-name [transform-set-name2 .... transform-set-name6]

19.    exit

20.    interface virtual-template number [typetunnel ]

21.    ip vrf forwarding vrf-name

22.    ip unnumbered type number

23.    tunnel mode ipsec ipv4 ipv4

24.    tunnel protection profile ipsec profile-name [shared]

25.    end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	ip vrf vrf-name Example: Router(config)# ip vrf VRF-100-1	Defines the VRF instance and enters VRF configuration mode
Step 4	rd route-distinguisher Example: Router(config-vrf)# rd 100:21	Creates routing and forwarding tables for a VRF.
Step 5	exit Example: Router(config-vrf)# exit	Exits VRF configuration mode and enters global configuration mode.
Step 6	crypto keyring keyring-name Example: Router(config)# crypto keyring cisco-100-1	Defines a crypto key ring and enters key ring configuration mode.
Step 7	pre-shared-key address key key Example: Router(config-keyring)# pre-shared-key address 10.1.1.1 key cisco-100-1	Defines the preshared key to be used for Internet Key Exchange (IKE) authentication.
Step 8	exit Example: Router(config-keyring)# exit	Exits keyring configuration mode and enters global configuration mode.
Step 9	crypto isakmp profile profile-name Example: Router(config)# crypto isakmp profile cisco-isakmp-profile-100-1	Defines an ISAKMP profile and enters ISAKMP configuration mode.
Step 10	keyring keyring-name Example: Router(conf-isa-prof)# keyring cisco-100-1	Configures a key ring in ISAKMP mode.
Step 11	match identity address mask Example: Router(conf-isa-prof)# match identity address 10.1.1.0 255.255.255.0	Matches an identity from the ISAKMP profile.
Step 12	virtual-template template-number Example: Router(conf-isa-prof)# virtual-template 101	Specifies the virtual template that will be used to clone virtual access interfaces.
Step 13	exit Example: Router(conf-isa-prof)# exit	Exits ISAKMP profile configuration mode and enters global configuration mode.
Step 14	crypto ipsec transform-set transform-set-name transform1 [transform2] [transform3] Example: Router(config)# crypto ipsec transform-set cisco esp-3des esp-sha-hmac	Defines the transform set and enters crypto transform configuration mode.
Step 15	exit Example: Router(conf-crypto-trans)# exit	Exits crypto transform configuration mode and enters global configuration mode.
Step 16	crypto ipsec profile name Example: Router(config)# crypto ipsec profile cisco-ipsec-profile-101	Defines the IPsec parameters used for IPsec encryption between two IPsec routers, and enters IPsec profile configuration mode.
Step 17	set security-policy limit maximum-limit Example: Router(ipsec-profile)# set security-policy limit 3	Defines an upper limit to the number of flows that can be created for an individual virtual access interface.
Step 18	set transform-set transform-set-name [transform-set-name2 .... transform-set-name6] Example: Router(ipsec-profile)# set transform-set cisco	Specifies the transform sets to be used with the crypto map entry.
Step 19	exit Example: Router(ipsec-profile)# exit	Exits IPsec profile and enters global configuration mode.
Step 20	interface virtual-template number [typetunnel ] Example: Router(config)# interface virtual-template 101 type tunnel	Creates a virtual template interface that can be configured and applied dynamically in creating a virtual access interface and enters interface configuration mode.
Step 21	ip vrf forwarding vrf-name Example: Router(config-if)# ip vrf forwarding VRF-100-1	Associates a VRF instance with a virtual-template interface.
Step 22	ip unnumbered type number Example: Router(config-if)# ip unnumbered GigabitEthernet 0.0	Enables IP processing on an interface without assigning an explicit IP address to the interface.
Step 23	tunnel mode ipsec ipv4 ipv4 Example: Router(config-if)# tunnel mode ipsec ipv4	Defines the mode for the tunnel.
Step 24	tunnel protection profile ipsec profile-name [shared] Example: Router(config-if)# tunnel protection ipsec profile PROF	Associates a tunnel interface with an IPsec profile.
Step 25	end Example: Router(config-if)# end	Exits interface configuration mode, and returns to privileged EXEC mode.

• Example: Verifying the Results for the IPsec Static Virtual Tunnel Interface

Router# show interface tunnel 0

Tunnel0 is up, line protocol is up
Hardware is Tunnel
Internet address is 10.0.51.203/24
MTU 1514 bytes, BW 9 Kbit, DLY 500000 usec,
reliability 255/255, txload 103/255, rxload 110/255
Encapsulation TUNNEL, loopback not set
Keepalive not set
Tunnel source 10.0.149.203, destination 10.0.149.217
Tunnel protocol/transport IPsec/IP
, key disabled, sequencing disabled
Tunnel TTL 255
Checksumming of packets disabled, fast tunneling enabled
Tunnel transmit bandwidth 8000 (kbps)
Tunnel receive bandwidth 8000 (kbps)
Tunnel protection via IPsec (profile "P1")
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 1/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/0 (size/max)
30 second input rate 13000 bits/sec, 34 packets/sec
30 second output rate 36000 bits/sec, 34 packets/sec
191320 packets input, 30129126 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
59968 packets output, 15369696 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 output buffer failures, 0 output buffers swapped out
Router# show crypto session
Crypto session current status
Interface: Tunnel0
Session status: UP-ACTIVE
Peer: 10.0.149.217 port 500
IKE SA: local 10.0.149.203/500 remote 10.0.149.217/500 Active
IPsec FLOW: permit ip 0.0.0.0/0.0.0.0 0.0.0.0/0.0.0.0
Active SAs: 4, origin: crypto map
Router# show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
C 10.0.35.0/24 is directly connected, FastEthernet3/3
S 10.0.36.0/24 is directly connected, Tunnel0
C 10.0.51.0/24 is directly connected, Tunnel0
C 10.0.149.0/24 is directly connected, FastEthernet3/0

• Example Verifying the Results for the Dynamic Virtual Tunnel Interface Easy VPN Server

Router# show running-config interface Virtual-Access2
Building configuration...
Current configuration : 250 bytes
!
interface Virtual-Access2
 ip unnumbered GigabitEthernet0/1
 ip virtual-reassembly
 tunnel source 172.18.143.246
 tunnel destination 172.18.143.208
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile test-vti1
 no tunnel protection ipsec initiate
end
Router# show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is 10.2.1.10 to network 0.0.0.0
     172.18.0.0/24 is subnetted, 1 subnets
C       172.18.143.0 is directly connected, GigabitEthernet0/1
     192.168.1.0/32 is subnetted, 1 subnets
S       192.168.1.1 [1/0] via 0.0.0.0, Virtual-Access2
     10.0.0.0/24 is subnetted, 1 subnets
C       10.2.1.0 is directly connected, GigabitEthernet0/2
S*   0.0.0.0/0 [1/0] via 172.18.143.1