IPsec
·
Certificate Authentication for IPsec: Trustpoints, Enrollment, and Revocation
Pre-shared keys are a fine way to learn IPsec and a poor way to run it. A PSK is
Labs
Hands-on Cisco IOS XE lab walkthroughs. Each lab ships with a real CML topology, configs you can paste, and verified show output. Articles tagged Labs cover the full CCNA 200-301 blueprint across Network Fundamentals, Network Access, IP Connectivity, IP Services, and Security Fundamentals.
Latest
IPsec
·
GETVPN Explained: Group Encryption Without Tunnels
GETVPN is the one VPN with no tunnels and no peers. Every site shares one group key. Real IOS XE captures prove it, including the packet capture that explains why GETVPN cannot cross the internet.
IPsec
·
Running a Cisco Router as a CA Server: PKI You Can Lab
PKI is one of those topics that everyone nods along to and almost nobody has actually built. You read about
IPsec
·
FlexVPN Explained: One Framework for Site-to-Site, Hub-Spoke, and Remote Access
Every Cisco engineer eventually inherits a router with four different VPN styles bolted onto it: a crypto map for the
IPsec
·
FlexVPN Spoke-to-Spoke: Dynamic Tunnels Without DMVPN
The design, the config, and exactly how far we got on a real cat8000v. Hub-and-spoke worked. The NHRP shortcut never fired. Here is how you tell the difference.
IPsec
·
FlexVPN Site-to-Site Configuration on IOS XE
FlexVPN is what happens when Cisco stops bolting features onto crypto maps and rebuilds the whole thing on top of
IPsec
·
IKEv2 Explained: Why It Replaced IKEv1 (and the Smart Defaults)
IKEv2 is not IKEv1 with a bigger version number. It is a different protocol, defined in a different RFC, with
IPsec
·
IKEv2 Site-to-Site VPN with Crypto Maps on IOS XE
You have a site-to-site VPN in production. It works. It has worked for years. It uses a crypto
IPsec
·
IKEv2 Site-to-Site VPN with SVTI: The Config You Should Actually Deploy
If you are building a brand new site-to-site tunnel in 2026, this is the one you should build:
IPsec
·
Crypto Maps vs VTI: Which Site-to-Site Design to Pick
Sooner or later someone hands you two routers, two sites, and "encrypt the traffic between them." On Cisco
IPsec
·
Static VTI (SVTI): The Modern Way to Build a Site-to-Site VPN
If you are still building site-to-site VPNs with crypto maps in 2026, you are configuring a router the
IPsec
·
Troubleshooting IPsec: Phase 1 Up, Phase 2 Down, and Other Classics
Every error message in this article came off a real router. Not a textbook, not a vendor doc, not a