> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Proxy-ID for Routed IPSec Connections

> This document describes how to enable IKE phase 2 Proxy-ID traffic selectors on route-based Site-to-Cloud IPSec connections so Aviatrix gateways interoperate with policy-based IPSec peers while remaining route-based on the Aviatrix side.

This document describes how to enable Proxy-ID negotiation on route-based IPSec
Site-to-Cloud connections in Aviatrix Controller version 9.0 or later.

## Introduction

Partner or third-party networks often terminate IPSec as **policy-based** VPN.
Those peers expect IKE phase 2 **traffic selectors** (Proxy-IDs) scoped to
specific source and destination CIDRs. Historically, Aviatrix route-based IPSec
negotiated a broad selector (for example `0.0.0.0/0`), which does not match
peers that require CIDR-specific selectors.

When **Proxy-ID for Routed Connections** is enabled on a route-based connection,
the gateway derives traffic selector pairs from the connection's configured
local and remote CIDR ranges and negotiates those selectors during IKE. The
Aviatrix gateway continues to use route mode with a virtual tunnel interface;
the remote peer can remain policy-based. **Distributed Cloud Firewall (DCF)**
continues to enforce policy on the Site-to-Cloud tunnel interface.

For more information about Site2Cloud and external device connectivity, refer
to:

* <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/vpn/s2c-configuration-workflow"}>Site2Cloud External Connection Workflow</a>
* <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/vpn/transit-externaldevice-workflow"}>Transit Gateway to External Devices Workflow</a>
* <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/gateways/external-connection-settings"}>External Connection Settings</a>

## Prerequisites

* Needs Aviatrix Controller version 9.0 or later.
* Needs a **route-based IPsec** Site-to-Cloud external connection (**Type** set
  to **Static Routing over IPsec** in CoPilot).

## Supported Connection Subtypes

Proxy-ID applies to the following Site-to-Cloud cases. In CoPilot, these
correspond to **Static Routing Type** options on the External Device wizard:

* **Unmapped NAT** — selectors follow the connection's real local and remote
  CIDRs.
* **Mapped NAT** — selectors follow virtual local CIDRs and real remote CIDRs.
* **Active Mesh** — Transit or Spoke external device connections.
* **Custom Mapped** — selectors follow the configured local and remote virtual
  and real CIDR pairs. CoPilot UI for this subtype is not yet available; use API
  or CLI.

## Configure Proxy-ID on a Route-Based Site-to-Cloud Connection

To configure Proxy-ID on a route-based Site-to-Cloud connection:

1. In CoPilot, go to **Networking** > **Connectivity** > **External Connections
   (S2C)**.
2. Click **+ External Connection** and select **External Device**.
3. Set **Type** to **Static Routing over IPsec**. Proxy-ID is supported only on
   this Type; it is not available on **BGP over IPsec**, **BGP over GRE**, or
   **BGP over LAN**.
4. Set **Static Routing Type** to **Unmapped NAT**, **Mapped NAT**, or **Active
   Mesh** (depending on the Site-to-Cloud subtype you need).
5. Select the **Local Gateway** and configure the **Remote Subnet CIDR(s)**.
   Local CIDRs are derived from the selected gateway.
6. Toggle **Proxy-ID** to **On**. Traffic selector pairs are derived
   automatically from the connection's CIDR ranges.
7. Enter the remaining connection parameters and click **Save**.

To enable Proxy-ID on an existing connection:

1. Go to **Networking** > **Connectivity** > **External Connections (S2C)**.
2. Select the route-based IPsec connection and click **Edit**.
3. Toggle **Proxy-ID** to **On**.
4. Click **Save**.

## Configure Proxy-ID on ActiveMesh Transit or Spoke to External Device

To configure Proxy-ID on an ActiveMesh Transit or Spoke external device
connection:

1. In CoPilot, go to **Networking** > **Connectivity** > **External Connections
   (S2C)**.
2. Click **+ External Connection** and select **External Device**. See
   <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/vpn/transit-externaldevice-workflow"}>Transit Gateway to External Devices Workflow</a>
   for the broader workflow context.
3. Set **Type** to **Static Routing over IPsec**.
4. Set **Static Routing Type** to **Active Mesh**.
5. Select the Transit or Spoke Gateway as the **Local Gateway** and configure
   the **Remote Subnet CIDR(s)**.
6. Toggle **Proxy-ID** to **On**.
7. Click **Save**.

<Note>
  Proxy-ID is not supported on **BGP** external connections or on tunnel
  protocols **other than IPSec**. The Controller returns an error if Proxy-ID is
  enabled on an unsupported combination.
</Note>

## Verifying Proxy-ID on the Connection

To verify Proxy-ID on the connection:

1. Open the external connection detail for the Site2Cloud or External Device
   connection.
2. Confirm **Proxy-ID Enabled** is **true** and review **Proxy-ID Pairs** for
   the expected local and remote CIDR pairs.
3. In CoPilot, go to **Diagnostics** > **Cloud Routes** > **External
   Connections** and confirm tunnel status for the connection.
4. If IKE negotiation fails, use **Diagnostics** > **Diagnostic Tools** >
   **Connectivity Diagnostics** or see
   <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/vpn/troubleshooting-ipsec-vpn-ikev2"}>Troubleshooting IPsec VPN Connection with IKEv2</a>
   . For general diagnostics, see
   <a href={"/docs/enterprise/" + "10.1" + "/reference/ui/diagnostics/diagnostic-tools"}>Diagnostic Tools</a>
   .

## Proxy-ID Limitations

* Proxy-ID applies to route-based IPSec Site-to-Cloud connections only.
  Policy-based connections already use explicit policies for traffic selection.
* For ActiveMesh Transit or Spoke to External Device, Proxy-ID requires
  **Static** routing and **IPSec**. **BGP** and **non-IPSec** tunnel protocols
  are not supported with Proxy-ID.
* Traffic selectors are derived **automatically** from configured CIDR ranges.
  You cannot specify selectors that do not align with those CIDRs.
* If no valid local or remote CIDR pairs can be derived, enabling Proxy-ID may
  **log an error** without blocking connection creation in all cases.
* CoPilot UI support may vary by Site2Cloud subtype; use **API** or **CLI** to
  configure Proxy-ID on **Mapped** or **Custom Mapped** workflows if the control
  is not yet shown in the UI.

## Related topics

* <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/vpn/s2c-configuration-workflow"}>Site2Cloud External Connection Workflow</a>
* <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/vpn/transit-externaldevice-workflow"}>Transit Gateway to External Devices Workflow</a>
* <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/gateways/external-connection-settings"}>External Connection Settings</a>
* <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/vpn/troubleshooting-ipsec-vpn-ikev2"}>Troubleshooting IPsec VPN Connection with IKEv2</a>