The ASA supports OSPF, EIGRP, RIP, and BGP, but with different defaults and its own opinions about which routes it installs. Get oriented with live captures from an ASAv 9.24 in CML before you configure any of them.
COOP key servers fix the GETVPN control plane, but there is a trap: mismatched RSA rekey keys pass every failover test and then kill the group at the next rekey. We hit it on purpose.
FVRF routes the tunnel's outer ESP packets; IVRF holds the decrypted inner traffic. Separate those two in your head and VRF-aware IPsec becomes bookkeeping. This guide builds the config from that distinction.
The hands-on GETVPN build on Cisco IOS XE. Key server first, then group members (nine lines, no peer, no ACL), then verification. Every command verified on cat8000v 17.18.02.
Pre-shared keys sit in plain sight in configs and backups and do not scale past a few peers. This article moves IPsec authentication to certificates: trustpoints, CA enrollment, and revocation, so each device holds its own key and enrolls once.
GETVPN is the one VPN with no tunnels and no peers. Every site shares one group key. Real IOS XE captures prove it, including the packet capture that explains why GETVPN cannot cross the internet.
A Cisco IOS XE router can act as a full certificate authority: about six lines of config to issue real X.509 certificates and enroll other routers over HTTP. Build a PKI you can actually lab.
FlexVPN collapses crypto maps, VTIs, DMVPN, and EzVPN into one IKEv2-based framework. See how a single configuration model covers site-to-site, hub-spoke, and remote access VPNs on Cisco IOS XE.
The design, the config, and exactly how far we got on a real cat8000v. Hub-and-spoke worked. The NHRP shortcut never fired. Here is how you tell the difference.
Build FlexVPN site to site on IOS XE: one authorization policy, one Virtual-Template, and the hub clones a Virtual-Access interface per spoke. Three cat8000v routers on 17.18.02 in a live CML lab, with real output throughout.
What actually changed from IKEv1 to IKEv2: different RFC, exchange, state machine, and show commands. Real output from a cat8000v on IOS XE explains why show crypto isakmp sa returns nothing on a healthy IKEv2 tunnel.
You do not have to rebuild a legacy crypto map VPN as a tunnel interface to get IKEv2. On Cisco IOS XE you keep the crypto map, the ACL, and the transform set and swap only the key exchange. This post shows how.