DVTI supports multiple IPsec SAs. The DVTI can accept multiple IPsec selectors that are proposed by the initiator.
The DVTIs allow per-peer features to be applied on a dedicated interface. You can order features in such way that all features
that are applied on the virtual access interfaces are applied before applying crypto. Additionally, all the features that
are applied on the physical interfaces are applied after applying crypto. Clean routing is available across all VRFs so that
there are no traffic leaks from one VRF to another before encrypting.
Multi-SA VTIs ensure interoperation with third-party devices and provide a flexible, clean, and modular feature-set.
Multi-SA VTIs enable a clean Cisco IOS XE infrastructure, even when the Cisco IOS XE software interoperates with the third-party
devices that only implement crypto maps.
VRF and Scalability of Baseline Configuration:
Virtual access instances inherit the Inside-VRF (IVRF) from the template configuration. Users must configure several templates
to enforce an appropriate IVRF for each customer. The number of templates must be equal to the number of customers connecting
to the headend. Such a configuration is cumbersome and undesirable and also affects performance because each template declaration
consumes one Interface Descriptor Block (IDB).
This complication can be avoided by allowing the IKE profile to override the virtual access VRF with the VRF configured on
the IKE profile. A better solution is to allow the IKE profile to override the virtual access VRF using AAA, but this method
is supported only for IKEv2.
The VRF configured in the ISAKMP profile is applied to the virtual access first. Then the configuration from virtual template
is applied to the virtual access. If your virtual template contains
ip vrf forwarding command configuration, the VRF from the template overrides the VRF from the ISAKMP profile.
Rules for Initial Configuration of a VRF:
The following rules must be applied during the initial configuration of VRF:
- If you configure IVRF in the IKE profile without configuring it in the virtual template, then you must apply the VRF from
the IKE profile on each virtual access derived from this IKE profile.
- If you configure VRF in an IKE profile and virtual template, then the virtual template IVRF gets precedence.
Rules for Changing the VRF:
If you change the VRF configured in an IKE profile, all the IKE SAs, IPsec SAs, and the virtual access identifier derived
from this profile will get deleted. The same rule applies when the VRF is configured on the IKE profile for the first time.