Site-to-site and remote-access VPN across Cisco platforms. Articles tagged VPN cover tunnel design, encryption choices, routing over the overlay, and how to prove traffic is actually protected.
Cisco removed Clientless SSL VPN (WebVPN) from the ASA in 9.17. Real 9.24 CLI proof, and the Secure Client remote-access VPN that replaced it.
Endpoint versus pass-through on the Cisco ASA: inspect ipsec-pass-thru, NAT-T on UDP 4500, and the classic Phase 1 up, Phase 2 down failure.
Map IKEv1 to IKEv2 on the Cisco ASA command by command, then cut a live site-to-site tunnel over without an outage.
A real LAN-to-LAN IKEv2 tunnel from a Cisco ASA to an IOS XE peer, verified with show vpn-sessiondb from a live CML capture.
COOP key servers fix the GETVPN control plane, but there is a trap: mismatched RSA rekey keys pass every failover test and then kill the group at the next rekey. We hit it on purpose.
VRF-aware IPsec has a reputation for being fiddly, and it mostly is not. What it has is two things
The hands-on GETVPN build on Cisco IOS XE. Key server first, then group members (nine lines, no peer, no ACL), then verification. Every command verified on cat8000v 17.18.02.
Pre-shared keys are a fine way to learn IPsec and a poor way to run it. A PSK is
GETVPN is the one VPN with no tunnels and no peers. Every site shares one group key. Real IOS XE captures prove it, including the packet capture that explains why GETVPN cannot cross the internet.
PKI is one of those topics that everyone nods along to and almost nobody has actually built. You read about
Every Cisco engineer eventually inherits a router with four different VPN styles bolted onto it: a crypto map for the
The design, the config, and exactly how far we got on a real cat8000v. Hub-and-spoke worked. The NHRP shortcut never fired. Here is how you tell the difference.