Modifying ACL for interesting traffic, does it require me to clear ipsec sa

tiki_turtle · ‎04-15-2009

I already have a VPN tunnel setup - I would like to add another subnet to the interesting traffic. Once I add the IP / subnet to the ACL for interesting traffic - do I have restart any negotiations between VPN peers?

Jon Marshall · ‎04-15-2009

Each individual entry in your crypto map acl for interesting traffic creates a separate ipsec sa (2 actuallu as ipsec sa's are unidirectional).

So no you should not have to clear the existing ipsec sa.

Jon

tiki_turtle · ‎04-15-2009

Thanks Jon - I remember reading that they were unidirectional...but was not aware that each entry creates a seperate sa...