On Sat, 2010-03-13 at 12:30 +0100, Gert Doering wrote: > On Thu, Mar 11, 2010 at 06:53:46PM +0100, Peter Rathlev wrote: > > Yes, and though I would like to use VTI the other end are not able to. > > So that's a no go. > > This surprises me somewhat. The config variant you use to configure the > IPSEC stuff on your end should be completely transparent to the other > side, as long as the resulting packets match: > > - IKE phase 1 + 2 proposals > - IKE phase 2 SA (= with crypto maps: tied to ACL lines) > - protocol stacking (IP-in-GRE-in-IPSEC?)
Really? I thought it had to match, but of course how should the other end know. I'll try the VTI way on this setup and report back how it went. -- Peter _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
