GETVPN (Group Encrypted Transport VPN) — Cisco IOS/IOS-XE
Group Encrypted Transport VPN for large enterprise MPLS networks. Preserves original IP headers (no encapsulation overhead), uses a centralized Key Server to distribute group keys to all Group Members.
What is it?
GETVPN (Group Encrypted Transport VPN) is a tunnel-less VPN technology for private WAN networks. Unlike DMVPN or FlexVPN which create GRE tunnels, GETVPN encrypts traffic in-place preserving the original IP headers. A centralized Key Server (KS) distributes group keys to all Group Members (GMs) using the GDOI (Group Domain of Interpretation) protocol. All GMs share the same encryption keys, enabling any-to-any encrypted communication with zero additional latency from encapsulation.
When to use
- ·Large enterprise MPLS networks where all sites communicate with each other
- ·When zero-overhead encryption is required (original IP headers preserved)
- ·Environments with 50+ sites sharing the same encryption policy
- ·When native multicast encryption support is required
- ·Replacing ATM/Frame-Relay frame-by-frame encryption with IP-based group encryption
When NOT to use
- ·Internet-based VPNs — GETVPN requires private IP connectivity (MPLS)
- ·Small networks — GETVPN overhead (Key Server, GDOI) isn't justified for fewer than 10 sites
- ·When sites need different encryption policies — all GMs share the same group policy
- ·Environments without MPLS or other private WAN transport
How it compares
Prerequisites
- →Private WAN (MPLS) connectivity between all sites — GETVPN does not work over the internet
- →IOS 12.4(22)T or later for GDOI/GETVPN support
- →RSA key pair configured on Key Server for rekey authentication ('crypto key generate rsa')
- →Minimum 2 Key Servers recommended for redundancy (cooperative Key Server mode)
- →All Group Members must be able to reach Key Server IP on UDP 848 (GDOI registration port)
Config Generator
Key Server distributes group keys; Group Members register with KS and apply encryption
Group identity number — must match across all Key Servers and Group Members
IKE pre-shared key between Key Server and Group Members
Key Server IP — used by Group Members to register; must be reachable on UDP 848
LAN-facing interface to which the GETVPN crypto map is applied
Group key rekey interval in seconds (default 86400 = 24h)
Source network for traffic to encrypt (Key Server only)
Wildcard mask for source network
Verification commands
show crypto gdoiVerify GDOI group state — on KS shows all registered GMs
ExpectedGroup state: ACTIVE; Group Members list populated on Key Server
show crypto gdoi ks membersKey Server: list all registered Group Members
ExpectedAll sites should appear with IP and registration time
show crypto gdoi gmGroup Member: verify registration status with Key Server
ExpectedGM State: Registered; Key Server should show as ACTIVE
show crypto isakmp saVerify IKE SA to Key Server is ACTIVE
ExpectedState QM_IDLE = ISAKMP SA established
show crypto mapVerify crypto map applied to interface
ExpectedCrypto map bound to correct LAN interface with GDOI group
Debug commands
debug crypto gdoiGDOI registration and rekey debug
WarningUse with caution in production — generates significant output during rekey events
debug crypto isakmpIKE negotiation between GM and KS
WarningUse 'debug crypto condition peer ipv4 <KS-IP>' to limit output
Common mistakes & fixes
Further learning
Recommended books to go deeper on this topic.
CCNP Security Virtual Private Networks SVPN 300-730 Official Cert Guide
Joseph Muniz, Steven Chimes, James Risler · Cisco Press · The only Cisco-approved SVPN study guide — covers DMVPN, FlexVPN, GETVPN, AnyConnect, and IKEv2 in depth
Integrated Security Technologies and Solutions — Volume I
Aaron Woland, Vivek Santuka, Jamie Sanbower, Chad Mitchell · Cisco Press · CCIE Professional Development · CCIE-level reference: NGFW, IPS, Advanced Threat Protection, VPN fundamentals
Integrated Security Technologies and Solutions — Volume II
Aaron Woland, Vivek Santuka, Jamie Sanbower, Chad Mitchell · Cisco Press · CCIE Professional Development · CCIE-level reference: NAC, segmentation, context sharing, VPN, encryption, virtualization
Network Security Technologies and Solutions
Yusuf Bhaiji · Cisco Press · CCIE Professional Development · Comprehensive CCIE Security reference — IPsec, IKE, VPN, AAA, PKI, firewalls all in one volume
CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide
Omar Santos · Cisco Press · Required for CCNP/CCIE Security — covers VPN, cryptography, network security architecture