IKEv2, AES-GCM-256, and a static VTI: the site-to-site config you should deploy today. No crypto ACLs, no proxy-ID mismatches, just a routable encrypted tunnel interface, captured live on two cat8000v routers running IOS XE 17.18.
Crypto map or VTI for your site-to-site IPsec tunnel? We built both designs on the same two IOS XE routers in CML, carried the same traffic, and captured the CLI differences so you can pick with evidence.
One command, tunnel mode ipsec ipv4, turns a tunnel interface into a routable IPsec-protected link. No crypto maps, no crypto ACLs, no GRE header. Built live on two cat8000v routers running IOS XE 17.18 across a simulated ISP in CML.
We built a live IPsec lab in CML, then broke the tunnel five different ways to capture exactly what IOS XE says for each failure. Phase 1 up, Phase 2 down, and the other classics, with real output.
ESP has no port numbers, so PAT kills raw IPsec: Phase 1 comes up, Phase 2 passes nothing. This article shows why, what NAT-T actually changes on the wire, and the failure and the fix in real CLI output from a live CML lab.
Configure GRE over IPsec on Cisco IOS XE with IKEv2 and IPsec profiles. Modern and legacy configs, MTU planning, OSPF over the tunnel, and gotchas.
What an SA is, why IKE runs in two phases, and which bytes of your packet actually get encrypted. Grounded in real packet captures on the transit link between two Cisco IOS XE edge routers in a CML lab.
Complete site-to-site IPsec VPN build with crypto maps on IOS XE: ISAKMP policy, keys, transform set, interesting traffic, and the crypto map itself, with every line of CLI output captured from live cat8000v routers in CML.