Certificate Authentication for IPsec: Trustpoints, Enrollment, and Revocation
Pre-shared keys are a fine way to learn IPsec and a poor way to run it. A PSK is
11 min read
IPsec
22 posts
GETVPN Explained: Group Encryption Without Tunnels
GETVPN is the one VPN with no tunnels and no peers. Every site shares one group key. Real IOS XE captures prove it, including the packet capture that explains why GETVPN cannot cross the internet.
12 min read
Running a Cisco Router as a CA Server: PKI You Can Lab
PKI is one of those topics that everyone nods along to and almost nobody has actually built. You read about
9 min read
FlexVPN Explained: One Framework for Site-to-Site, Hub-Spoke, and Remote Access
Every Cisco engineer eventually inherits a router with four different VPN styles bolted onto it: a crypto map for the
10 min read
FlexVPN Spoke-to-Spoke: Dynamic Tunnels Without DMVPN
The design, the config, and exactly how far we got on a real cat8000v. Hub-and-spoke worked. The NHRP shortcut never fired. Here is how you tell the difference.
10 min read
FlexVPN Site-to-Site Configuration on IOS XE
FlexVPN is what happens when Cisco stops bolting features onto crypto maps and rebuilds the whole thing on top of
12 min read