About Virtual Tunnel Interfaces
ASA supports a logical interface called the Virtual Tunnel Interface (VTI). As an alternative to policy-based VPN, you can create a VPN tunnel between peers using VTIs. VTIs support route-based VPN with IPsec profiles attached to the end of each tunnel. You can use dynamic or static routes. Egressing traffic from the VTI is encrypted and sent to the peer, and the associated SA decrypts the ingress traffic to the VTI.
Using VTI does away with the requirement of configuring static crypto map access lists and mapping them to interfaces. You no longer have to track all remote subnets and include them in the crypto map access list. Deployments become easier, and having static VTI which supports route-based VPN with dynamic routing protocol also satisfies many requirements of a virtual private cloud.
Static VTI
You can use static VTI configurations for site-to-site connectivity in which a tunnel is always-on between two sites. For a static VTI interface, you must define a physical interface as a tunnel source. You can associate a maximum of 1024 VTIs per device. To create a static VTI interface, see Add a VTI Interface.
Dynamic VTI
Dynamic VTI provides highly secure and scalable connectivity for site-to-site VPNs. Dynamic VTI eases the configuration of peers for large enterprise hub and spoke deployments. A single dynamic VTI can replace several static VTI configurations on the hub. You can add new spokes to a hub without changing the hub configuration. Dynamic VTI replaces dynamic crypto maps and the dynamic hub-and-spoke method for establishing tunnels. In the management center, dynamic VTI supports only the hub and spoke topology.
Dynamic VTI uses a virtual template for dynamic instantiation and management of IPsec interfaces. The virtual template dynamically generates the virtual access interface that is unique for each VPN session. Dynamic VTI supports multiple IPsec security associations and accepts multiple IPsec selectors proposed by the spoke. Dynamic VTI also supports dynamic (DHCP) spokes. To create a dynamic VTI interface, see Add a Dynamic VTI Interface.
How Does an ASA Create a Dynamic VTI Tunnel for a VPN Session
-
Create a virtual template on ASA (interface virtual-Template template_number type tunnel).
You can use this template for multiple VPN sessions.
-
Attach this template to a tunnel group. You can attach a virtual template to multiple tunnel groups.
-
Spoke initiates a tunnel request with the hub.
-
Hub authenticates the spoke.
-
ASA uses the virtual template to dynamically create a virtual access interface on the hub for the VPN session with the spoke.
-
Hub establishes a dynamic VTI tunnel with the spoke using the virtual access interface.
-
Configure the IKEv2 route set interface command to advertise the VTI interface IP over IKEv2 exchanges. This option enables unicast reachability between the VTI interfaces for BGP or path monitoring to work over the tunnel.
-
After the VPN session ends, the tunnel disconnects and the hub deletes the corresponding virtual access interface.