Site-to-site and remote-access VPN across Cisco platforms. Articles tagged VPN cover tunnel design, encryption choices, routing over the overlay, and how to prove traffic is actually protected.
Build FlexVPN site to site on IOS XE: one authorization policy, one Virtual-Template, and the hub clones a Virtual-Access interface per spoke. Three cat8000v routers on 17.18.02 in a live CML lab, with real output throughout.
What actually changed from IKEv1 to IKEv2: different RFC, exchange, state machine, and show commands. Real output from a cat8000v on IOS XE explains why show crypto isakmp sa returns nothing on a healthy IKEv2 tunnel.
You do not have to rebuild a legacy crypto map VPN as a tunnel interface to get IKEv2. On Cisco IOS XE you keep the crypto map, the ACL, and the transform set and swap only the key exchange. This post shows how.
IKEv2, AES-GCM-256, and a static VTI: the site-to-site config you should deploy today. No crypto ACLs, no proxy-ID mismatches, just a routable encrypted tunnel interface, captured live on two cat8000v routers running IOS XE 17.18.
Crypto map or VTI for your site-to-site IPsec tunnel? We built both designs on the same two IOS XE routers in CML, carried the same traffic, and captured the CLI differences so you can pick with evidence.
One command, tunnel mode ipsec ipv4, turns a tunnel interface into a routable IPsec-protected link. No crypto maps, no crypto ACLs, no GRE header. Built live on two cat8000v routers running IOS XE 17.18 across a simulated ISP in CML.
We built a live IPsec lab in CML, then broke the tunnel five different ways to capture exactly what IOS XE says for each failure. Phase 1 up, Phase 2 down, and the other classics, with real output.
ESP has no port numbers, so PAT kills raw IPsec: Phase 1 comes up, Phase 2 passes nothing. This article shows why, what NAT-T actually changes on the wire, and the failure and the fix in real CLI output from a live CML lab.
Configure GRE over IPsec on Cisco IOS XE with IKEv2 and IPsec profiles. Modern and legacy configs, MTU planning, OSPF over the tunnel, and gotchas.
What an SA is, why IKE runs in two phases, and which bytes of your packet actually get encrypted. Grounded in real packet captures on the transit link between two Cisco IOS XE edge routers in a CML lab.
Complete site-to-site IPsec VPN build with crypto maps on IOS XE: ISAKMP policy, keys, transform set, interesting traffic, and the crypto map itself, with every line of CLI output captured from live cat8000v routers in CML.