Cisco Systems CL-28826-01 Configuring IPsec Proposals in Site-to-Site VPNs

25-21

User Guide for Cisco Security Manager 4.4

OL-28826-01

Chapter25 Configuring IKE and IPsec Policies

Understanding IPsec Proposals

•For dynamic crypto maps, routes are created upon the successful establishment of IPsec security

associations (SAs) for those remote proxies. The next hop back to those remote proxies is through

the remote VPN router whose address is learned and applied during the creation of the dynamic

crypto map template. The routes are deleted after the SAs are deleted.

•The Remote Peer option (available for IOS devices only) enables you to specify an interface or

address as the explicit next hop to the remote VPN device. Two routes are created. One route is the

standard remote proxy ID and the next hop is the remote VPN client tunnel address. The second

route is the actual route to the remote tunnel endpoint, when a recursive lookup is forced to impose

that the remote endpoint is reachable via “next-hop.” Creation of the second route for the actual next

hop is very important for VRF-Aware IPsec when a default route must be overridden by a more

explicit route.

Note For devices using a VPN Services Module (VPNSM), the next hop is the interface or

subinterface/VLAN on which the crypto map is applied.

•In the case of Remote Peer IP (available for IOS devices only), one route is created to a remote proxy

by way of a user-defined next hop. The next hop can be used to override a default route to properly

direct outgoing encrypted packets. This option reduces the number of routes created and supports

those platforms that do not readily facilitate route recursion.