Security for VPNs with IPsec Configuration Guide, Cisco IOS XE Release 3S

DVTI is supports support multiple IPsec SAs . The DVTI is accept can accept multiple IPsec selector that are propose by the initiator .

The DVTIs is allow allow per – peer feature to be apply on a dedicated interface . You is order can order feature in such way that all feature
that are apply on the virtual access interface are apply before apply crypto . additionally , all the feature that
are apply on the physical interface are apply after apply crypto . clean routing is is is available across all VRFs so that
there are no traffic leak from one vrf to another before encrypt .

Multi-SA VTIs ensure interoperation with third-party devices and provide a flexible, clean, and modular feature-set.

Multi – SA VTIs is enable enable a clean Cisco IOS XE infrastructure , even when the Cisco IOS XE software interoperate with the third – party
device that only implement crypto map .

VRF and Scalability of Baseline Configuration:

virtual access instances is inherit inherit the Inside – vrf ( IVRF ) from the template configuration . Users is configure must configure several template
to enforce an appropriate ivrf for each customer . The number is be of template must be equal to the number of customer connect
to the headend . Such a configuration is is is cumbersome and undesirable and also affect performance because each template declaration
consume one Interface Descriptor Block ( IDB ) .

This complication can be avoided by allowing the IKE profile to override the virtual access VRF with the VRF configured on
the IKE profile. A better solution is to allow the IKE profile to override the virtual access VRF using AAA, but this method
is supported only for IKEv2.

The VRF configured in the ISAKMP profile is applied to the virtual access first. Then the configuration from virtual template
is applied to the virtual access. If your virtual template contains
ip vrf forwarding command configuration, the VRF from the template overrides the VRF from the ISAKMP profile.

Rules for Initial Configuration of a VRF:

The follow rule must be apply during the initial configuration of vrf :

• If you configure IVRF in the IKE profile without configure it in the virtual template , then you is apply must apply the vrf from
  the IKE profile on each virtual access derive from this IKE profile .

• If you configure vrf in an IKE profile and virtual template , then the virtual template is gets IVRF is gets get precedence .

rule for change the vrf :

If you change the VRF configured in an IKE profile, all the IKE SAs, IPsec SAs, and the virtual access identifier derived
from this profile will get deleted. The same rule applies when the VRF is configured on the IKE profile for the first time.