GRE over IPsec: Why Tunnels and Encryption Belong Together
Configure GRE over IPsec on Cisco IOS XE with IKEv2 and IPsec profiles. Modern and legacy configs, MTU planning, OSPF over the tunnel, and gotchas.
Jaime
Latest posts — page 21
IPsec Explained: IKE Phase 1, Phase 2, and What Actually Gets Encrypted
What an SA is, why IKE runs in two phases, and which bytes of your packet actually get encrypted. Grounded in real packet captures on the transit link between two Cisco IOS XE edge routers in a CML lab.
Site-to-Site IPsec VPN with Crypto Maps on Cisco IOS XE
Complete site-to-site IPsec VPN build with crypto maps on IOS XE: ISAKMP policy, keys, transform set, interesting traffic, and the crypto map itself, with every line of CLI output captured from live cat8000v routers in CML.
Model-Driven Telemetry on IOS XE Routers: gRPC Dial-Out in Practice
Model-driven telemetry replaces SNMP polling with continuous streaming from the device. This article covers the MDT subscription model on IOS XE, dial-in vs dial-out over gRPC, and the honest platform picture.
Advanced EEM: Tcl, Multi-Event Correlation, and EEM + Python
Go past one-line EEM applets: multi-event correlation, Tcl policies, and EEM as the trigger for on-box Python. Includes a real applet firing and capturing device state in a CML lab.
JSON vs XML vs YAML for Network Engineers: One Payload, Three Ways
One interface configuration rendered as JSON, XML, and YAML from a single Python dictionary. See why RESTCONF, NETCONF, and Ansible each picked their format and how all three encode the same data model.
Jinja2 Templates for Network Configs: From Variables to Rendered CLI
Stop hand-editing pasted router configs. This post builds the full templating pipeline: YAML variables, a Jinja2 template, rendered CLI, and a Netmiko push to a live router, all captured from a real CML lab.
On-Box Python: Scripting IOS XE from the Inside
On-box Python puts automation scripts on the IOS XE device itself, so they run even when the management network is down. Covers the cli module, where scripts run, and the honest platform picture, with a fully captured off-box pipeline as reference.
Guest Shell on IOS XE: Linux Inside Your Router
Guest Shell is a Linux container running on your router's own hardware, with access to the IOS XE CLI from inside it. Run Python and script the box with no external automation host. What it is, why it matters, and where you can run it.
Expert Services Troubleshooting: NAT, DHCP, and SLA Ticket Scenarios
NAT, DHCP, and IP SLA faults rarely leave clues in show ip route. Five services ticket scenarios with the exact translation table, binding, or tracking object to check for each, grounded in real lab behavior.
IPv6 Services Closure: NPTv6, DHCPv6-PD, and General Prefix
DHCPv6 prefix delegation, general prefixes, and NPTv6: the IPv6 services engineers often skip, shown with real CML output of a delegated prefix flowing all the way to a downstream interface.
Embedded Packet Capture: Wireshark Inside Your Router
Embedded Packet Capture puts Wireshark-grade capture inside the IOS XE router itself: no SPAN, no capture laptop, no cabling. Includes a real on-router capture from a CML lab and the syntax difference that will bite you.