GETVPN Explained: Group Encryption Without Tunnels
GETVPN is the one VPN with no tunnels and no peers. Every site shares one group key. Real IOS XE captures prove it, including the packet capture that explains why GETVPN cannot cross the internet.
VPN
Site-to-site and remote-access VPN across Cisco platforms. Articles tagged VPN cover tunnel design, encryption choices, routing over the overlay, and how to prove traffic is actually protected.
Latest posts — page 2
Running a Cisco Router as a CA Server: PKI You Can Lab
A Cisco IOS XE router can act as a full certificate authority: about six lines of config to issue real X.509 certificates and enroll other routers over HTTP. Build a PKI you can actually lab.
FlexVPN Explained: One Framework for Site-to-Site, Hub-Spoke, and Remote Access
FlexVPN collapses crypto maps, VTIs, DMVPN, and EzVPN into one IKEv2-based framework. See how a single configuration model covers site-to-site, hub-spoke, and remote access VPNs on Cisco IOS XE.
FlexVPN Spoke-to-Spoke: Dynamic Tunnels Without DMVPN
The design, the config, and exactly how far we got on a real cat8000v. Hub-and-spoke worked. The NHRP shortcut never fired. Here is how you tell the difference.
FlexVPN Site-to-Site Configuration on IOS XE
Build FlexVPN site to site on IOS XE: one authorization policy, one Virtual-Template, and the hub clones a Virtual-Access interface per spoke. Three cat8000v routers on 17.18.02 in a live CML lab, with real output throughout.
IKEv2 Explained: Why It Replaced IKEv1 (and the Smart Defaults)
What actually changed from IKEv1 to IKEv2: different RFC, exchange, state machine, and show commands. Real output from a cat8000v on IOS XE explains why show crypto isakmp sa returns nothing on a healthy IKEv2 tunnel.
IKEv2 Site-to-Site VPN with Crypto Maps on IOS XE
You do not have to rebuild a legacy crypto map VPN as a tunnel interface to get IKEv2. On Cisco IOS XE you keep the crypto map, the ACL, and the transform set and swap only the key exchange. This post shows how.
IKEv2 Site-to-Site VPN with SVTI: The Config You Should Actually Deploy
IKEv2, AES-GCM-256, and a static VTI: the site-to-site config you should deploy today. No crypto ACLs, no proxy-ID mismatches, just a routable encrypted tunnel interface, captured live on two cat8000v routers running IOS XE 17.18.
Crypto Maps vs VTI: Which Site-to-Site Design to Pick
Crypto map or VTI for your site-to-site IPsec tunnel? We built both designs on the same two IOS XE routers in CML, carried the same traffic, and captured the CLI differences so you can pick with evidence.
Static VTI (SVTI): The Modern Way to Build a Site-to-Site VPN
One command, tunnel mode ipsec ipv4, turns a tunnel interface into a routable IPsec-protected link. No crypto maps, no crypto ACLs, no GRE header. Built live on two cat8000v routers running IOS XE 17.18 across a simulated ISP in CML.
Troubleshooting IPsec: Phase 1 Up, Phase 2 Down, and Other Classics
We built a live IPsec lab in CML, then broke the tunnel five different ways to capture exactly what IOS XE says for each failure. Phase 1 up, Phase 2 down, and the other classics, with real output.
NAT Traversal (NAT-T): How IPsec Survives a NAT Device
ESP has no port numbers, so PAT kills raw IPsec: Phase 1 comes up, Phase 2 passes nothing. This article shows why, what NAT-T actually changes on the wire, and the failure and the fix in real CLI output from a live CML lab.