Cisco IOS / IOS-XEConfig1,187 downloads

Cisco IOS Site-to-Site IPSec VPN

IKEv1 or IKEv2 site-to-site IPSec VPN tunnel between two Cisco IOS/IOS-XE routers. Generates crypto policy, keyring, profile, transform-set, ACL, and crypto map.

↓ example.txt

What is it?

IPSec VPN creates an encrypted tunnel between two sites over the public internet. IPSec uses two phases: Phase 1 (IKE) negotiates a secure channel to protect Phase 2. Phase 2 (IPSec) establishes the actual data tunnel. IKEv2 (recommended) is faster, more reliable, and supports features like MOBIKE for mobile clients. The 'interesting traffic' ACL defines which traffic triggers the tunnel — typically the local LAN accessing the remote LAN.

When to use

·Site-to-site connectivity between two offices over the internet
·Connecting a branch office to HQ without paying for MPLS circuits
·Disaster Recovery connectivity between primary and backup data centers
·Connecting to cloud providers (AWS, Azure) via VPN Gateway
·Partner/vendor connectivity for specific application traffic

When NOT to use

·Remote access VPN for individual users — use AnyConnect (SSL VPN) instead, much easier for end users
·High-bandwidth real-time traffic (video production) — VPN encryption adds latency and overhead
·When SD-WAN is already deployed — SD-WAN typically manages its own overlay tunnels

How it compares

vs MPLSMPLS is a private carrier circuit — no encryption needed, guaranteed bandwidth, but expensive. IPSec VPN uses the public internet — requires encryption, bandwidth is best-effort, but much cheaper. Many organizations replace MPLS with IPSec + SD-WAN.

vs SSL VPN (AnyConnect)SSL VPN is for individual remote users connecting from laptops/phones. IPSec site-to-site is for connecting entire office networks. Different use cases.

vs GRE tunnelGRE is an unencrypted tunnel — it encapsulates traffic but doesn't protect it. IPSec encrypts. Often combined: GRE over IPSec provides both routing protocol support and encryption.

Prerequisites

→Public IP address on both ends (or NAT traversal configured if behind NAT)
→Pre-shared key agreed upon between both sites (use certificates for production)
→Crypto policy parameters must match exactly on both ends (encryption, hash, DH group)
→Internet connectivity with UDP 500 and UDP 4500 (NAT-T) open between peers
→ACL defining interesting traffic — must be mirror images on both sides

Config Generator

Hostname *

IKE Version

Remote Peer IP *

Local WAN Interface *

Pre-Shared Key *

IKE Encryption

IKE Integrity

IKE DH Group

ESP Encryption

ESP Integrity

IKE SA Lifetime (sec)

IPSec SA Lifetime (sec)

Transform-set Name

Crypto Map Name

Crypto Map Sequence

Crypto ACL Name

Interesting Traffic (Crypto ACL)

PFS Group

Verification commands

show crypto ikev2 sa

Verify IKEv2 Phase 1 is established

ExpectedShows SA state as 'READY'. If empty, Phase 1 never completed.

show crypto ipsec sa

Verify IPSec Phase 2 tunnels and packet counts

ExpectedShows 'pkts encaps' and 'pkts decaps' incrementing. If they're zero, traffic isn't hitting the tunnel.

show crypto map

Show crypto map configuration and which interfaces it's applied to

ExpectedShows the ACL, peer, and transform-set for each crypto map entry

Debug commands

debug crypto ikev2 error

Debug IKEv2 Phase 1 negotiation errors

WarningModerate output. Check for mismatched proposals or PSK errors. Run 'undebug all' after.

debug crypto ipsec error

Debug Phase 2 errors — transform-set mismatches, PFS issues

WarningUse during maintenance window only.

Common mistakes & fixes

SymptomIKEv2 SA not establishing — 'INIT_SA_SENT' never completes

CauseUDP 500 blocked by firewall, wrong peer IP, or proposal mismatch

FixTest connectivity: 'ping <peer-ip>'. Verify both sides use the same IKEv2 proposal (encryption, hash, DH group). Check firewall allows UDP 500 and 4500.

SymptomPhase 1 up but Phase 2 not establishing

CauseTransform-set mismatch or crypto ACL not mirrored correctly

FixVerify transform-set matches on both ends. Check crypto ACL: local side should be 'permit ip LOCAL_NET WILD REMOTE_NET WILD', remote side should be the exact inverse.

SymptomTunnel up but traffic not passing

CauseMissing return route or NAT intercepting VPN traffic before encryption

FixAdd static route to remote subnet via the tunnel. If NAT is configured, add a NAT exemption ACL so VPN traffic is NOT translated.

SymptomVPN drops periodically

CauseIKE lifetime mismatch causing renegotiation failure, or DPD (Dead Peer Detection) timeout

FixMatch lifetime on both ends. Check DPD: 'show crypto ikev2 sa detail'. Ensure both peers are reachable at all times.

Further learning

Recommended books to go deeper on this topic.

Cisco ASA: All-in-One Next-Gen Firewall, IPS, and VPN Services

Jazib Frahim, Omar Santos, Andrew Ossipov · Cisco Press · Site-to-site IPsec, IKEv1/v2, crypto maps, tunnel interfaces

Kindle ↗Hardcover ↗

IKEv2 IPsec Virtual Private Networks — Understanding and Deploying IKEv2, IPsec VPNs, and FlexVPN in Cisco IOS

Graham Bartlett, Amjad Inamdar · Cisco Press · The definitive IKEv2 and FlexVPN reference — crypto fundamentals, keyring, profiles, DVTI, spoke-to-spoke

Paperback ↗

CCNP Security Virtual Private Networks SVPN 300-730 Official Cert Guide

Joseph Muniz, Steven Chimes, James Risler · Cisco Press · The only Cisco-approved SVPN study guide — covers DMVPN, FlexVPN, GETVPN, AnyConnect, and IKEv2 in depth

Kindle ↗Hardcover ↗

Network Security Technologies and Solutions

Yusuf Bhaiji · Cisco Press · CCIE Professional Development · Comprehensive CCIE Security reference — IPsec, IKE, VPN, AAA, PKI, firewalls all in one volume

Kindle ↗Hardcover ↗Paperback ↗

CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide

Omar Santos · Cisco Press · Required for CCNP/CCIE Security — covers VPN, cryptography, network security architecture

Kindle ↗Paperback ↗