IPsec Through an ASA: NAT-T, ESP Pass-Through, and Why the Tunnel Won't Come Up
Endpoint versus pass-through on the Cisco ASA: inspect ipsec-pass-thru, NAT-T on UDP 4500, and the classic Phase 1 up, Phase 2 down failure.
IPsec
The encryption suite underneath almost every Cisco VPN. Articles tagged IPsec cover IKEv2 negotiation, transform sets, SA lifetimes, and reading a phase 1 or phase 2 failure.
Latest posts
IKEv1 vs IKEv2 on the ASA: Migrating a Site-to-Site Tunnel
Map IKEv1 to IKEv2 on the Cisco ASA command by command, then cut a live site-to-site tunnel over without an outage.
LAN-to-LAN IPsec VPN on the ASA with IKEv2
A real LAN-to-LAN IKEv2 tunnel from a Cisco ASA to an IOS XE peer, verified with show vpn-sessiondb from a live CML capture.
GETVPN Redundancy: COOP Key Servers and Rekey Survival
COOP key servers fix the GETVPN control plane, but there is a trap: mismatched RSA rekey keys pass every failover test and then kill the group at the next rekey. We hit it on purpose.
VRF-Aware IPsec: Keeping VPNs in Their Lane
FVRF routes the tunnel's outer ESP packets; IVRF holds the decrypted inner traffic. Separate those two in your head and VRF-aware IPsec becomes bookkeeping. This guide builds the config from that distinction.
GETVPN Configuration: Key Server, Group Members, and GDOI
The hands-on GETVPN build on Cisco IOS XE. Key server first, then group members (nine lines, no peer, no ACL), then verification. Every command verified on cat8000v 17.18.02.
Certificate Authentication for IPsec: Trustpoints, Enrollment, and Revocation
Pre-shared keys sit in plain sight in configs and backups and do not scale past a few peers. This article moves IPsec authentication to certificates: trustpoints, CA enrollment, and revocation, so each device holds its own key and enrolls once.
GETVPN Explained: Group Encryption Without Tunnels
GETVPN is the one VPN with no tunnels and no peers. Every site shares one group key. Real IOS XE captures prove it, including the packet capture that explains why GETVPN cannot cross the internet.
Running a Cisco Router as a CA Server: PKI You Can Lab
A Cisco IOS XE router can act as a full certificate authority: about six lines of config to issue real X.509 certificates and enroll other routers over HTTP. Build a PKI you can actually lab.
FlexVPN Explained: One Framework for Site-to-Site, Hub-Spoke, and Remote Access
FlexVPN collapses crypto maps, VTIs, DMVPN, and EzVPN into one IKEv2-based framework. See how a single configuration model covers site-to-site, hub-spoke, and remote access VPNs on Cisco IOS XE.
FlexVPN Spoke-to-Spoke: Dynamic Tunnels Without DMVPN
The design, the config, and exactly how far we got on a real cat8000v. Hub-and-spoke worked. The NHRP shortcut never fired. Here is how you tell the difference.
FlexVPN Site-to-Site Configuration on IOS XE
Build FlexVPN site to site on IOS XE: one authorization policy, one Virtual-Template, and the hub clones a Virtual-Access interface per spoke. Three cat8000v routers on 17.18.02 in a live CML lab, with real output throughout.