Configure Routing and AC Policies for VTI

After you configure VTI interfaces and the VTI tunnel on both the devices, you must configure:

A routing policy to route VTI traffic between the devices over the VTI tunnel.
An access control rule to allow encrypted traffic.

Routing Configuration for VTI

For the VTI interfaces, you can configure static route or routing protocols such as BGP, EIGRP, OSPF/OSPFv3.

Choose Devices > Device Management, and edit the threat defense device.
Click Routing.
Configure static route, or BGP, EIGRP, OSPF/OSPFv3.


Routing	Parameters	More Information
Static Route	Interface—Select the VTI interface. For a backup tunnel, select the backup VTI interface. Selected Network—Remote peer’s protected network. Gateway—Remote peer’s tunnel interface IP address. For a backup tunnel, select the remote peer’s backup tunnel interface IP address. Metric—For a backup tunnel, configure a different metric to handle the failover of the traffic flow over the backup tunnel.	Add a Static Route
BGP	Under General Settings > BGP, enable BGP, provide the AS number of the local device, and add Router ID (if you choose Manual). Under BGP, enable IPv4/IPv6 and click the Neighbor tab to configure the neighbors. IP Address—Remote peer’s VTI interface IP address. For a backup tunnel, add a neighbor with the remote peer's backup VTI interface IP address. Remote AS—Remote peer’s AS number. Click the Redistribution tab, select the Source Protocol as Connected to enable connected route redistribution.	Configure BGP
EIGRP	Enable EIGRP, provide the AS number of the local device, and select the networks or hosts that participate in the EIGRP routing process. Click the Neighbors tab and define the static neighbors for the EIGRP process. To advertise summary addresses from a VTI interface, click the Summary Address tab, choose the VTI interface from the Interface drop-down. From the Network drop-down, choose the network to be summarized. Click the Interfaces tab to configure the interface-specific EIGRP routing properties for the VTI interface. To enable EIGRP split-horizon on the interface, check the Split Horizon check box. You can also configure the Hold Time that is advertised by the device in the EIGRP hello packets.
OSPF	Check the Process 1 check box, and choose the OSPF role. Click the Interface tab and choose a VTI interface.	Configure OSPFv2
OSPFv3	Check the Process 1 and Enable Process 1 check boxes, and choose the OSPFv3 role. Click the Interface tab and choose a VTI interface.	Configure OSPFv3

AC Policy Rule

Add an access control rule to the access control policy on the device to allow encrypted traffic between the VTI tunnels with the following settings:

Create the rule with the Allow action.
Select the VTI security zone of the local device as the source zone and the VTI security zone of the remote peer as the destination zone.
Select the VTI security zone of the remote peer as the source zone and the VTI security zone of the local device as the destination zone.

For more information about configuring an access control rule, see Create and Edit Access Control Rules.