Cisco IOS / IOS-XEConfig634 downloads

FlexVPN Site-to-Site — Cisco IOS/IOS-XE

IKEv2-based FlexVPN site-to-site tunnel with Dynamic VTI (hub) or Static VTI (spoke). The successor to DMVPN — supports per-spoke QoS, VRF-aware tunnels, and dynamic routing. Requires IOS 15.2+.

↓ example.txt

What is it?

FlexVPN is Cisco's next-generation VPN framework built on IKEv2. It unifies site-to-site, remote access, and hub-spoke VPN into a single scalable framework using IKEv2 and Virtual Tunnel Interfaces (VTI). Unlike DMVPN which uses mGRE+NHRP, FlexVPN uses IKEv2's built-in routing update extensions and supports per-spoke QoS, VRF awareness, and seamless failover. The Hub uses a Dynamic VTI (DVTI) with a Virtual-Template that spawns a virtual-access interface per spoke. Spokes use a Static VTI (SVTI) pointing to the hub.

When to use

·New hub-and-spoke VPN deployments — FlexVPN is the recommended successor to DMVPN
·When per-spoke QoS policies are required (not possible in DMVPN)
·Remote access VPN on IOS routers as an AnyConnect headend
·VRF-aware site-to-site tunnels
·When IKEv2-only features are needed: EAP authentication, rapid failover, MOBIKE

When NOT to use

·Routers running IOS older than 15.2 (FlexVPN requires 15.2+)
·When existing DMVPN infrastructure is stable (migration cost without clear benefit)
·Simple two-site VPN — use standard static IPsec VTI instead
·Non-Cisco spoke routers — DVTI is Cisco-proprietary

How it compares

vs DMVPNDMVPN uses mGRE+NHRP over IKEv1 or IKEv2. FlexVPN uses DVTI+IKEv2 natively. FlexVPN scales better, supports per-tunnel QoS, and has simpler IKEv2 configuration. FlexVPN requires IOS 15.2+.

vs Static IPsec VTIStatic VTI requires an individual tunnel per remote site. FlexVPN hub uses a single Virtual-Template that dynamically spawns a virtual-access interface per spoke.

vs GETVPNGETVPN requires private WAN (MPLS) and uses a group key model. FlexVPN works over internet and creates per-peer IKEv2 tunnels with full per-spoke policy control.

Prerequisites

→IOS 15.2(2)T or later (IOS-XE 3.6S+ recommended)
→AAA configuration required: 'aaa new-model' and authorization group for DVTI
→Loopback interface recommended as tunnel IP source (stays up regardless of WAN state)
→IKEv2 smart license on older ISR platforms
→Spoke must have reachability to hub WAN IP on UDP 500 and UDP 4500 (NAT-T)

Config Generator

Router Hostname *

Device Role

Hub = DVTI server; Spoke = connects to hub

Local WAN IP *

Local WAN or loopback IP for IKEv2 identity

Peer IP *

Remote peer IP; use 0.0.0.0 for dynamic spokes (hub only)

Virtual-Template / Tunnel Number *

Hub uses Virtual-Template; spoke uses static Tunnel interface

Tunnel / Loopback IP *

Hub Loopback IP (unnumbered source); spoke static tunnel IP

Local LAN Subnet *

Local LAN Subnet Mask *

IKEv2 Pre-Shared Key *

Encryption Algorithm

Integrity Algorithm

Diffie-Hellman Group

Group 19 (ECDH P-256) recommended for FlexVPN

Pseudo-Random Function (PRF)

Configure EIGRP routing

EIGRP AS Number

Configure eBGP over FlexVPN tunnel

BGP Local AS

BGP Peer AS

Verification commands

show crypto ikev2 sa

IKEv2 SA state for all peers

ExpectedREADY = Phase 1 established

show crypto session

Full tunnel session state

ExpectedUP-ACTIVE = both IKE and IPsec SAs are established

show interface Virtual-Access*

Hub: per-spoke dynamically created interfaces

ExpectedOne Virtual-Access interface per connected spoke; line protocol should be up

show ip route

Verify routes learned over FlexVPN tunnel

ExpectedSpoke prefixes should appear via EIGRP (D) or BGP (B) routes

show crypto ipsec sa

IPsec SA packet counters

Expectedpkts encrypt and pkts decrypt incrementing confirms data path is working

Debug commands

debug crypto ikev2 packet

IKEv2 negotiation exchange

WarningUse 'debug crypto condition peer ipv4 <IP>' to limit output to one peer

debug crypto ikev2 error

IKEv2 error messages only — less verbose than full packet debug

WarningUse in production with caution; turn off with 'undebug all'

Common mistakes & fixes

SymptomVirtual-Access interface not created on hub

CauseMissing 'virtual-template <n>' in ikev2 profile, or aaa authorization not configured

FixVerify 'aaa new-model', 'aaa authorization network default local', and 'virtual-template' line in ikev2 profile

SymptomIKEv2 SA comes up but no traffic passes

CauseRouting not configured — tunnel IP must be reachable and routing protocol active

FixVerify EIGRP or BGP is configured and routing protocol adjacency formed over the tunnel

SymptomIKEv2 negotiation fails with NO_PROPOSAL_CHOSEN

CauseIKEv2 proposal mismatch — encryption, integrity, PRF, or DH group differs

FixEnsure crypto ikev2 proposal is identical on hub and spoke for all parameters

SymptomTunnel connects but drops after ~1 hour

CauseIKEv2 SA rekey failure — often a routing issue when rekey traffic uses wrong path

FixCheck SA lifetime: 'show crypto ikev2 sa detail'. Ensure routing to peer is stable during rekey window.

Further learning

Recommended books to go deeper on this topic.

IKEv2 IPsec Virtual Private Networks — Understanding and Deploying IKEv2, IPsec VPNs, and FlexVPN in Cisco IOS

Graham Bartlett, Amjad Inamdar · Cisco Press · The definitive IKEv2 and FlexVPN reference — crypto fundamentals, keyring, profiles, DVTI, spoke-to-spoke

Paperback ↗

CCNP Security Virtual Private Networks SVPN 300-730 Official Cert Guide

Joseph Muniz, Steven Chimes, James Risler · Cisco Press · The only Cisco-approved SVPN study guide — covers DMVPN, FlexVPN, GETVPN, AnyConnect, and IKEv2 in depth

Kindle ↗Hardcover ↗

CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide

Omar Santos · Cisco Press · Required for CCNP/CCIE Security — covers VPN, cryptography, network security architecture

Kindle ↗Paperback ↗