Hello!

It would be great if they could add a function to create a VTI (Virtual Tunnel Interface) for IPSec for Site-to-Site VPN. This technology is implemented starting from Cisco / Huawei equipment and on Pfsense / OPNsense. Setting up IPSec is different in that we no longer need to manually create a crypto-map (and therefore an ACL); instead, we create an IPSec profile that is tied to a dedicated tunnel interface (VTI). The difference from the previously used Crypto map is that now there is no need to create an ACL - all traffic entering the tunnel is encrypted (encryption maps are nevertheless still created, but automatically).
Advantages of IPSec VTI compared to classic IPSec:
1. Setting up and controlling encrypted traffic is greatly simplified (you can use QoS, ZBF, etc.). Unencrypted traffic is processed on the virtual interface, encrypted traffic is processed on the physical interface.
2. IPSec VTI supports multicast, and, consequently, dynamic routing protocols - BGP, OSPF, EIGRP, etc.