# Next-Hop Tunnel Binding Table

You can bind multiple IPSec VPN tunnels to a single tunnel interface. To link a specific destination to one of a number of VPN tunnels bound to the same tunnel interface, the security device uses two tables: the route table and the next-hop tunnel binding (NHTB). The security device maps the next-hop gateway IP address specified in the route table entry to a particular VPN tunnel specified in the NHTB table. With this technique, a single tunnel interface can support many VPN tunnels.

For example, a route table entry to 10.1.2.0/24 might specify 10.1.3.1 as the next-hop gateway, where 10.1.3.1 is the IP address of a remote IKE peer's tunnel interface: set vrouter trust-vr route 10.1.2.0/24 interface tunnel.1 gateway 10.1.3.1. When the security device receives traffic destined for 10.1.2.0/24, the route table specifies the tunnel interface—tunnel.1 in this case—but it does not specify which VPN tunnel to use. If there is only one VPN tunnel bound to tunnel.1, specifying the tunnel interface is enough. If there are more than one VPN tunnel bound to the interface, there needs to be a link between the route and a specific tunnel. The NHTB table provides that link. An NHTB table entry for this example might be set interface tunnel.1 nhtb 10.1.3.1 vpn vpn1, in which "vpn1" is the name of the VPN tunnel leading to the remote IKE peer with an internal subnet of 10.1.2.0/24. Using the unique IP address 10.1.3.1 that both the route table entry and NHTB table entry have in common, the security device can forward traffic destined for 10.1.2.0/24 to tunnel.1 and use the appropriate VPN tunnel ("vpn1").

### To Make a New Next Hop Entry

1. In the IP Address field, enter the IP address of the tunnel interface at the remote peer's site.

Note: Because the security device uses this IP address to distinguish one VPN tunnel among others, it must be unique.

3. From the VPN drop-down list, select the VPN tunnel to the remote peer whose tunnel interface IP address you entered in the IP Address field.

4. Click Add.

The NHTB table contains the following fields:

Flag: This flag can be either "S" for Static or "A" for Automatic.

Note: The security devices at both ends of the VPN tunnel must be running ScreenOS 5.0.0 for the automatic population of the NHTB table to work.

Next Hop (IP): The IP address of a remote peer's tunnel interface.

VPN: The name of the VPN tunnel leading to the remote peer whose tunnel interface has the IP address in the Next Hop (IP) column.

Status: The status of an NHTB entry can be Ready, Inactive, Up, or Down.

Configure: Click Remove to delete an NHTB table entry.