Cisco
Login
Search
Software Secure Firewall Threat Defense
Platform Secure Firewall Threat Defense Virtual
Activity Onboard

Onboard Devices to Cloud-Delivered Firewall Management Center Device Management Using Device Templates Configure Site-to-Site VPN Connections in a Device Template Configure a Route-Based Site-to-Site VPN Connection

Last updated: Jul 29, 2025

Configure a Route-Based Site-to-Site VPN Connection

You can configure a route-based site-to-site VPN connection to add spokes to route-based site-to-site VPN topologies using the device template.

Before you begin

Procedure

1

Choose Devices > Template Management.

2

Click the edit icon adjacent to the device template that you want to edit.
3

Click the VPN tab.
4

Click Add VPN Connection.

5

Choose a route-based site-to-site VPN topology from the VPN Topology drop-down list.

The Add VPN Connection dialog box expands and you can configure the following parameters:

  1. From the Virtual Tunnel Interface (VTI) drop-down list, choose a VTI interface or click (add icon) to create a new VTI.

    VTI is a virtual interface used to establish a route-based VPN tunnel. You must configure routing policies for a VTI to set up a VPN tunnel. This list contains all the VTIs configured on the device template. For more information on creating a VTI, see Add a VTI Interface.

  2. Check the Use Public IP Address check box to override the tunnel source IP address and configure a public IP address variable for the VTI. Click (add icon) to create a new public IP address variable.

    This IP address is the source IP address for the VPN tunnel. By default, this is the IP address of the VPN interface. However, if the device is behind NAT, the VPN interface has a private address, but the post-NAT public IP address should be configured.

  3. Check the Local Tunnel (IKE) Identity check box to enable a unique and configurable identity for the VPN tunnel from the spoke to a remote peer.

  4. Identity Type: Key ID is the only supported identity type. Choose a key ID variable from the drop-down list or click (add icon) to create a new key ID variable.

  5. (Optional) Check the Enable Secondary VPN Tunnel check box to configure the parameters for the secondary VPN tunnel.

  6. Click OK.

    You can view the VPN connection in the Site-to-Site VPN Connections table.
6

Click Save.

What to do next

  1. Configure the routing policy for the spoke in the device template.

  2. Map the device interfaces to the template interfaces (Model Mapping).

  3. Apply the template to a device.

Previous topic Configure an SD-WAN VPN Connection Next topic Configure a Policy-Based Site-to-Site VPN Connection