Virtual Tunnel Interface
This chapter describes how to configure a VTI tunnel.
About Virtual Tunnel Interfaces
The ASA supports a logical interface called Virtual Tunnel Interface (VTI). As an alternative to policy based VPN, a VPN tunnel can be created between peers with Virtual Tunnel Interfaces configured. This supports route based VPN with IPsec profiles attached to the end of each tunnel. This allows dynamic or static routes to be used. Egressing traffic from the VTI is encrypted and sent to the peer, and the associated SA decrypts the ingress traffic to the VTI.
Using VTI does away with the requirement of configuring static crypto map access lists and mapping them to interfaces. You no longer have to track all remote subnets and include them in the crypto map access list. Deployments become easier, and having static VTI which supports route based VPN with dynamic routing protocol also satisfies many requirements of a virtual private cloud.
Guidelines for Virtual Tunnel Interfaces
General Configuration Guidelines
You can use dynamic or static routes for traffic using the tunnel interface.
The MTU for VTIs is automatically set, according to the underlying physical interface.
VTI supports IKEv1 and uses IPsec for sending and receiving data between the tunnel's source and destination.
If Network Address Translation has to be applied, the IKE and ESP packets will be encapsulated in the UDP header.
IKE and IPsec security associations will be re-keyed continuously regardless of data traffic in the tunnel. This ensures that VTI tunnels are always up.
Tunnel group name must match what the peer will send as its IKEv1 identity.
For IKEv1 in LAN-to-LAN tunnel groups, you can use names which are not IP addresses, if the tunnel authentication method is digital certificates and/or the peer is configured to use aggressive mode.
VTI and crypto map configurations can co-exist on the same physical interface, provided the peer address configured in the crypto map and the tunnel destination for the VTI are different.
By default, all traffic through VTI is encrypted.
There are no security level configurations for VTI interfaces.
Access list can be applied on a VTI interface to control traffic through VTI.
Only BGP is supported over VTI.
Supported in single mode only.
Supported in routed mode only.
Create a VTI Tunnel
To configure a VTI tunnel, create an IPsec proposal (transform set). You will need to create an IPsec profile that references the IPsec proposal, followed by a VTI interface with the IPsec profile. Configure the remote peer with identical IPsec proposal and IPsec profile parameters. SA negotiation will start when all tunnel parameters are configured.
For the ASA which is a part of both the VPN VTI domains, and has BGP adjacency on the physical interface:
When a state change is triggered due to the interface health check, the routes in the physical interface will be deleted until BGP adjacency is re-established with the new active peer. This behavior does not apply to logical VTI interfaces.
||Add an IPsec Proposal (Transform Sets).|
||Add an IPsec Profile.|
||Add a VTI Tunnel.|
Add an IPsec Proposal (Transform Sets)
A transform set is required to secure traffic in a VTI tunnel. Used as a part of the IPsec profile, it is a set of security protocols and algorithms that protects the traffic in the VPN.
Before You Begin
You can use either pre-shared key or certificates for authenticating the IKEv1 session associated with a VTI. You must configure the pre-shared key under the tunnel group used for the VTI.
For certificate based authentication using IKEv1,you must specify the trustpoint to be used at the initiator. For the responder, you must configure the trustpoint in the tunnel-group command.
||In the IKEv1 IPsec Proposals (Transform Sets) panel, click Add.
VTI supports IKEv1 only.
- Enter the Set Name.
- Retain the default selection of the Tunnel check box.
- Select ESP Encryption and ESP Authentication.
- Click OK.
Add an IPsec
An IPsec profile
contains the required security protocols and algorithms in the IPsec proposal
or transform set that it references. This ensures a secure, logical
communication path between two site-to-site VTI VPN peers.
Profile panel, click
IKE v1 IPsec
Proposal created for the IPsec profile.
||If you need an
end of the VTI tunnel to act only as a responder, check the
only check box.
security association lifetime check box, and enter the security association
duration values in
check box to enable PFS, and select the required Diffie-Hellman
Forward Secrecy (PFS) generates a unique session key for each encrypted
exchange. This unique session key protects the exchange from subsequent
decryption. To configure PFS, you have to select the Diffie-Hellman key
derivation algorithm to use when generating the PFS session key. The key
derivation algorithms generate IPsec security association (SA) keys. Each group
has a different size modulus. A larger modulus provides higher security, but
requires more processing time. You must have matching Diffie-Hellman groups on
This establishes the strength of the of the
encryption-key-determination algorithm. The ASA uses this algorithm to derive
the encryption and hash keys.
Proposals (Transform Sets) main panel, click
Commands dialog box, click
Add a VTI Interface
To create a new VTI interface and establish a VTI tunnel, perform the following steps:
Implement IP SLA to ensure that the tunnel remains up when a router in the active tunnel is unavailable. See Configure Static Route Tracking in the ASA General Operations Configuration Guide in http://www.cisco.com/go/asa-config.
||Choose Add VTI Interface window appears.. The |
||In the General tab, enter the VTI ID. This can be any value from 0 to 100. Up to 100 VTI interfaces are supported.
If you will be migrating configurations from other devices to ASA 5506 devices, use the tunnel ID range of 1 - 100. This is to ensure compatibility of tunnel range of 1 - 100 available in ASA 5506 devices.
||Enter the Interface Name. Ensure the Enable Interface checkbox is checked.|
||Enter the source IP Address of the tunnel and the Subnet Mask.|
||Click the Advanced tab.
All the fields need to have valid values or selections for the tunnel to be displayed in the VPN Wizard.
||Enter the Destination IP address.|
||Select the Source Interface.|
||Select the IPsec profile in the Tunnel Protection with IPsec Profile field.|
||Check the Ensure the Enable Tunnel Mode IPv4 IPsec check box.|
||In the Interfaces panel, click Apply.|
||In the Preview CLI Commands dialog box, click Send.
After the updated configuration is loaded, the new VTI appears in the list of interfaces. This new VTI can be used to create an IPsec site-to-site VPN.