RRI is the ability for static routes to be automatically inserted into the routing process for those networks and hosts that
are protected by a remote tunnel endpoint. These protected hosts and networks are known as remote proxy identities.
Each route is created on the basis of the remote proxy network and mask, with the next hop to this network being the remote
tunnel endpoint. By using the remote VPN router as the next hop, the traffic is forced through the crypto process to be encrypted.
After the static route is created on the VPN router, this information is propagated to upstream devices, allowing them to
determine the appropriate VPN router to which to send returning traffic in order to maintain IPsec state flows. Being able
to determine the appropriate VPN router is particularly useful if multiple VPN routers are used at a site to provide load
balancing or failover or if the remote VPN devices are not accessible via a default route. Routes are created in either the
global routing table or the appropriate virtual route forwarding (VRF) table.
RRI is applied on a per-crypto map basis, whether this is via a static crypto map or a dynamic crypto map template. The default
behavior for the two map types is as follows:
In the case of a dynamic crypto map, routes are created upon the successful establishment of IPsec security associations (SAs)
for those remote proxies. The next hop back to those remote proxies is via the remote VPN router whose address is learned
and applied during the creation of the dynamic crypto map template. The routes are deleted after the SAs are deleted. Routes
created on the basis of IPsec source proxies on static crypto maps is the default behavior on static maps and overrides the
creation of routes on the basis of crypto ACLs (see the next bullet).
For static crypto maps, routes are created on the basis of the destination information defined in the crypto access list.
The next hop is taken from the first set peer statement that is attached to the crypto map. If at any time, RRI, the peer,
or the access list is removed from the crypto map, routes will be deleted. This behavior changes with the addition of the
RRI enhancements, as explained in the sections below.