CCIE-level material for engineers past the CCNP line. Articles tagged CCIE cover expert-track routing, overlays, security and automation, with full configs and real device output from CML.
Pre-shared keys sit in plain sight in configs and backups and do not scale past a few peers. This article moves IPsec authentication to certificates: trustpoints, CA enrollment, and revocation, so each device holds its own key and enrolls once.
GETVPN is the one VPN with no tunnels and no peers. Every site shares one group key. Real IOS XE captures prove it, including the packet capture that explains why GETVPN cannot cross the internet.
A Cisco IOS XE router can act as a full certificate authority: about six lines of config to issue real X.509 certificates and enroll other routers over HTTP. Build a PKI you can actually lab.
FlexVPN collapses crypto maps, VTIs, DMVPN, and EzVPN into one IKEv2-based framework. See how a single configuration model covers site-to-site, hub-spoke, and remote access VPNs on Cisco IOS XE.
The design, the config, and exactly how far we got on a real cat8000v. Hub-and-spoke worked. The NHRP shortcut never fired. Here is how you tell the difference.
Build FlexVPN site to site on IOS XE: one authorization policy, one Virtual-Template, and the hub clones a Virtual-Access interface per spoke. Three cat8000v routers on 17.18.02 in a live CML lab, with real output throughout.
What actually changed from IKEv1 to IKEv2: different RFC, exchange, state machine, and show commands. Real output from a cat8000v on IOS XE explains why show crypto isakmp sa returns nothing on a healthy IKEv2 tunnel.
You do not have to rebuild a legacy crypto map VPN as a tunnel interface to get IKEv2. On Cisco IOS XE you keep the crypto map, the ACL, and the transform set and swap only the key exchange. This post shows how.
IKEv2, AES-GCM-256, and a static VTI: the site-to-site config you should deploy today. No crypto ACLs, no proxy-ID mismatches, just a routable encrypted tunnel interface, captured live on two cat8000v routers running IOS XE 17.18.
Crypto map or VTI for your site-to-site IPsec tunnel? We built both designs on the same two IOS XE routers in CML, carried the same traffic, and captured the CLI differences so you can pick with evidence.
One command, tunnel mode ipsec ipv4, turns a tunnel interface into a routable IPsec-protected link. No crypto maps, no crypto ACLs, no GRE header. Built live on two cat8000v routers running IOS XE 17.18 across a simulated ISP in CML.
We built a live IPsec lab in CML, then broke the tunnel five different ways to capture exactly what IOS XE says for each failure. Phase 1 up, Phase 2 down, and the other classics, with real output.