3D Innovations 3.0.1 appendix IPSec Two-Box Solution

Appendix B Site-to-Site VPN User Interface Reference

Create VPN Wizard

Table B-11	Edit Endpoints Dialog Box > VRF Aware IPSec Tab (continued)
Element		Description
Enable VRF Settings		When selected, enables the configuration of VRF settings on the
		selected hub for the selected hub-and-spoke topology.
		Note To remove VRF settings that were defined for the VPN
		topology, deselect this check box.
1-Box (IPSec Aggregator +		When selected, enables you to configure a one-box VRF solution.
MPLS PE)		In the one-box solution, one device serves as the Provider Edge (PE)
		router that does the MPLS tagging of the packets in addition to
		IPSec encryption and decryption from the Customer Edge (CE)
		devices. For more information, see VRF-Aware IPSec One-Box
		Solution, page 9-42.
2-Box (IPSec Aggregator Only)		When selected, enables you to configure a two-box VRF solution.
		In the two-box solution, the PE device does just the MPLS tagging,
		while the IPSec Aggregator device does the IPSec encryption and
		decryption from the CEs. For more information, see VRF-Aware
		IPSec Two-Box Solution, page 9-43.
VRF Name		The name of the VRF routing table on the IPSec Aggregator. The
		VRF name is case-sensitive.
Route Distinguisher		The unique identifier of the VRF routing table on the IPSec
		Aggregator.
		This unique route distinguisher maintains the routing separation for
		each VPN across the MPLS core to the other PE routers.
		The identifier can be in either of the following formats:
		• IP address:X (where X is in the range 0-999999999).
		• N:X (where N is in the range 0-65535, and X is in the range
		0-999999999).
		Note You cannot override the RD identifier after deploying the
		VRF configuration to your device. To modify the RD
		identifier after deployment, you must manually remove it
		using the device CLI, and then deploy again.

	User Guide for Cisco Security Manager 3.0.1
B-30	OL-8214-02