32-8
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 32 Managing Remote Access VPNs on IOS and PIX 6.3 Devices
Configuring an IPsec Proposal on a Remote Access VPN Server (IOS, PIX 6.3 Devices)
When this feature is enabled, Security Manager implicitly creates the virtual template interface for the
selected device in a remote access VPN. All you must do is provide the IP address on the server that will
be used as the virtual template interface, or use an existing loopback interface. The virtual template
interface is created on the remote client without an IP address.
Notes
•You can configure dynamic VTI only on routers running Cisco IOS Release 12.4(2)T and later,
except 7600 devices.
•You can configure dynamic VTI with or without VRF-Aware IPsec. For more information about
VRF-Aware IPsec, see Understanding VRF-Aware IPsec, page 24-14.
•You can also configure dynamic VTI in a site-to-site Easy VPN topology. For more information, see
Easy VPN with Dynamic Virtual Tunnel Interfaces, page 27-2.
Navigation Path
In the IPsec Proposal Editor Dialog Box (for IOS routers and Catalyst 6500/7600 devices), click the
Dynamic VTI/VRF Aware IPsec tab. For more information, see IPsec Proposal Editor (IOS, PIX 6.3
Devices), page 32-4.
Related Topics
•Configuring an IPsec Proposal on a Remote Access VPN Server (IOS, PIX 6.3 Devices), page32-3
•Creating Interface Role Objects, page 6-68
Field Reference
Table32-3 IPsec Proposal Editor, Dynamic VTI/VRF Aware IPsec Tab
Element Description
Enable Dynamic VTI When selected, enables Security Manager to implicitly create a
dynamic virtual template interface on an IOS router.
Note Dynamic VTI can be configured only on IOS routers running
Cisco IOS Release 12.4(2)T and later, except 7600 devices. If
the device does not support Dynamic VTI, the option is greyed
out.
Enable VRF Settings When selected, enables you to configure VRF settings on the device for
the selected hub-and-spoke topology.
Note To remove VRF settings that were defined for the VPN
topology, deselect this check box.
User Group When you configure a remote access VPN server, remote clients must
have the same group name as the user group object configured on the
VPN server so that they can connect to the device.
Enter the name of the user group policy object associated with the
device, or click Select to select it from a list. You can also create new
objects or edit existing ones from the selection list.