In which VPN type are the Virtual Tunnel interfaces (VTI) used?

Route-based IPsec VPNs are configured by creating a Virtual Tunnel Interface (VTI). This VTI acts as a routable interface, and traffic is directed into the IPsec tunnel by adding static or dynamic routes that point to this interface. This design allows for more flexible and scalable network configurations, especially when using dynamic routing protocols like BGP over the VPN connection. The VTI essentially abstracts the underlying IPsec security associations, allowing the network to treat the VPN tunnel as a simple point-to-point link.

A. SSL-based VPN: This is a remote access solution for individual clients and operates differently, typically creating a virtual network adapter on the client, not an IPsec VTI on a gateway.
B. Route & SSL based VPNs: This option is incorrect because SSL-based VPNs do not use VTIs, making the combination invalid in this context.
C. Policy & Route based VPNs: This option is incorrect because policy-based VPNs do not use VTIs; they use security policies (like access control lists) to define which traffic to encrypt.

1. VMware NSX-T Data Center Administration Guide (Version 3.2)

Chapter: "VPN"

Section: "IPsec VPN".

The documentation states

"Route-based IPsec VPN is configured by creating a virtual tunnel interface (VTI) and setting up static routes or BGP to the VTI to provide connectivity to the remote site." This directly links VTIs to the route-based VPN type.

2. VMware NSX-T Data Center Administration Guide (Version 4.1)

Chapter: "VPN"

Section: "IPsec VPN".

This newer version reiterates the same principle: "With a route-based VPN

you create a virtual tunnel interface (VTI) and then configure static or dynamic routes that point to the peer subnet through the VTI." It contrasts this with policy-based VPNs

which "do not have VTIs."