Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a difference between a VTI (Virtual Tunnel Interface) and a regular VPN tunneling process?

Or have I got the whole concept wrong?

share|improve this question

Quick Googling indicates (1,2) that the idea of VTI is to use virtual interfaces to de-attach the routing from the VPN tunnel.

Specifically, IPsec configuration typically requires you to specify the IP networks that you want the IPsec engine to handle. As a result of that handling, the packets are encapsulated and so the routing decision for that packets implicitly changes. So to understand how packets are routed you have to understand the routing table AND the IPsec security policy (SPD).

What Cisco proposes in the above pages is to use another layer of encapulation, GRE(3), to detach routing from the VPN channels. They setup virtual interfaces with GRE that provide a simple IP tunnel. Then they configure IPsec to work only for those configured GRE tunnels(based on their outer IP headers, which you can chose to be small networks(transfer network, /2) with untypical IP addresses.

As a result, you can use the regular (much more flexible) routing tools on these interfaces to determine which traffic should go through the IPsec tunnel.

This can make sense in case you have many VPNs with sometimes changing IPs, or in some very special setups. For example, I recently had the problem to connect two networks with IPsec and also let network A be the Internet gateway for the other network B. That means network B has no dedicated Internet but should have a default route towards network A. It also means that the IPsec policy should apply to all traffic(, which apparently does not work in practice in Linux. So we used GRE tunneling and set the default route towards the virtual interface provided by GRE.

Not new technology but certainly has the potential to ease use and management in some cases..

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.