32-10
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 32 Managing Remote Access VPNs on IOS and PIX 6.3 Devices
Configuring an IPsec Proposal on a Remote Access VPN Server (IOS, PIX 6.3 Devices)
Interface Towards Provider
Edge
Available only for 2-Box VRF.
The VRF forwarding interface on the IPsec Aggregator towards the PE
device. Click Select to select the interface or interface role object, or to
create a new object that identifies the interface.
Note If the IPsec Aggregator (hub) is a Catalyst VPN service module,
you must specify a VLAN.
Routing Protocol Available only for 2-Box VRF.
Select the routing protocol to use between the IPsec Aggregator and the
PE. The options are BGP, EIGRP, OSPF, RIPv2, or Static route.
If the routing protocol for the secured IGP differs from the routing
protocol between the IPsec Aggregator and the PE, select the routing
protocol for redistributing the routing to the secured IGP.
AS Number Available only for 2-Box VRF with BGP or EIGRP routing.
The number to use to identify the autonomous system (AS) area
between the IPsec Aggregator and the PE. The AS number must be
between 1 and 65535.
If the routing protocol for the secured IGP differs from the routing
protocol between the IPsec Aggregator and the PE, enter an AS number
that identifies the secured IGP into which the routing will be
redistributed from the IPsec Aggregator and the PE. This is relevant
only if GRE or DMVPN are applied.
Process Number Available only for 2-Box VRF with OSPF routing.
The routing process ID number to use to configure the routing between
the IPsec Aggregator and the PE. The process number must be between
1 and 65535.
OSPF Area ID Available only for 2-Box VRF with OSPF routing.
The ID number of the area in which the packet belongs. You can enter
any number from 0 to 4294967295.
Note All OSPF packets are associated with a single area, so all
devices must have the same area ID number.
Redistribute Static Route Available only for 2-Box VRF with any routing protocol other than
Static route.
When selected, enables static routes to be advertised in the routing
protocol configured on the IPsec Aggregator towards the PE device.
Note If this check box is deselected and Enable Reverse Route
Injection is enabled (default) for the IPsec proposal, static
routes are still advertised in the routing protocol on the IPsec
Aggregator.
Next Hop IP Address Available only for 2-Box VRF with Static routing.
The IP address of the provider edge device (or the interface that is
connected to the IPSec aggregator).
Table32-3 IPsec Proposal Editor, Dynamic VTI/VRF Aware IPsec Tab (Continued)
Element Description