User's Manual

ManualsBrandsCisco Systems ManualsSecurity CameraCisco Systems CL-28826-01

1031

24-43

User Guide for Cisco Security Manager 4.4

OL-28826-01

Chapter 24 Managing Site-to-Site VPNs: The Basics

Creating or Editing VPN Topologies

Field Reference

Table 24-8 Edit Endpoints Dialog Box, VPN Interface Tab’s VPNSM/VPN SPA/VSPA Settings

Element Description

Enable the VPN Interface

Changes on All Selected

Peers

Note Available if you selected more than one Catalyst 6500/7600

device for editing in the Endpoints page.

When selected, applies any changes you make in the VPN interface tab

to all the selected devices.

VPNSM/VPN SPA/VSPA

Settings

• Use Crypto Connect Alternate—When selected, only encrypted

traffic entering the VPNSM/VPN SPA on the Catalyst 6500/7600

is passed through. Clear text traffic does not go through (bypasses)

the adapters. To use this option, the Catalyst 6500 must be running

version 12.2(33)SXH or later, and the 7600 router must be running

12.2(33)SRA or later.

This mode is recommended as an alternate to Crypto connect mode

for enterprise customers who have a need to support large VPN

topologies (financial institutions, for example) or need to pass

large amounts of data over an encrypted channel (remote disaster

recovery or backup over the Internet).

• Inside VLAN—The VLAN that serves as the inside interface to

the service module or adapter. It is also the hub endpoint of the

VPN tunnel (unless VRF-Aware IPsec is configured on the device).

Enter the name of the VLAN or interface role object, or click

Select to select it from a list.

• Slot and Subslot—The number designating the slot location of the

VPNSM or VPNSPA/VSPA. If you are configuring a

VPNSPA/VSPA, the subslot number is also required.

• Outside VLAN/External port—The external port or VLAN that

connects to the inside VLAN. Enter the name of the VLAN or

interface role object, or click Select to select it from a list. You

must select an interface or interface role that differs from the one

selected for the inside VLAN.

Note If VRF-Aware IPsec is configured on the device, the external

port or VLAN must have an IP address.