IPsec - Ping Labz

IPsec through an ASA: inspect ipsec-pass-thru and the UDP 4500 NAT-T rule

ASA

IPsec Through an ASA: NAT-T, ESP Pass-Through, and Why the Tunnel Won't Come Up

Endpoint versus pass-through on the Cisco ASA: inspect ipsec-pass-thru, NAT-T on UDP 4500, and the classic Phase 1 up, Phase 2 down failure.

J

Jul 13, 2026 8 min read

ASA IKEv1 versus IKEv2 config mapping for a site-to-site migration

ASA

IKEv1 vs IKEv2 on the ASA: Migrating a Site-to-Site Tunnel

Map IKEv1 to IKEv2 on the Cisco ASA command by command, then cut a live site-to-site tunnel over without an outage.

J

Jul 13, 2026 7 min read

ASA IKEv2 site-to-site tunnel in show vpn-sessiondb with AES256 and DH14

ASA

LAN-to-LAN IPsec VPN on the ASA with IKEv2

A real LAN-to-LAN IKEv2 tunnel from a Cisco ASA to an IOS XE peer, verified with show vpn-sessiondb from a live CML capture.

J

Jul 13, 2026 9 min read

GETVPN COOP failover: real syslog showing the secondary key server promoting to primary

IPsec

GETVPN Redundancy: COOP Key Servers and Rekey Survival

COOP key servers fix the GETVPN control plane, but there is a trap: mismatched RSA rekey keys pass every failover test and then kill the group at the next rekey. We hit it on purpose.

J

Jul 13, 2026 10 min read

IPsec

VRF-Aware IPsec: Keeping VPNs in Their Lane

VRF-aware IPsec has a reputation for being fiddly, and it mostly is not. What it has is two things

J

Jul 13, 2026 10 min read

GETVPN key server: real show crypto gdoi ks output with two registered group members

IPsec

GETVPN Configuration: Key Server, Group Members, and GDOI

The hands-on GETVPN build on Cisco IOS XE. Key server first, then group members (nine lines, no peer, no ACL), then verification. Every command verified on cat8000v 17.18.02.

J

Jul 13, 2026 12 min read