IPsec

What It Is

IPsec protects IP traffic with encryption, integrity, peer authentication, and anti-replay. Modern site-to-site VPNs usually use IKEv2 and route-based tunnels, often with VTIs, cloud VPN gateways, or firewall tunnel interfaces. The important operational questions are: how peers authenticate, what traffic is protected, which proposals match, how routes enter the tunnel, and what NAT or MTU does to the path.

Core Pieces

Modern note: People still say phase 1 and phase 2, but IKEv2 uses IKE SA and Child SA terminology.

Ports And Protocols

Watch out: Allowing UDP/500 but blocking UDP/4500 breaks many real VPNs because NAT-T is common even when only one side is behind NAT.

Modes

Design note: Route-based VPNs are easier to operate with dynamic routing, failover, monitoring, and multiple prefixes.

Crypto Choices

Watch out: Cloud VPN and firewall peers often support overlapping but not identical proposal sets. Match exact encryption, integrity, DH group, lifetime, PFS, and traffic selectors.

Route And Selector Design

Modern note: If both sides use 0.0.0.0/0 selectors, understand whether the VPN is full tunnel, default route, or just broad policy matching.

Cisco IOS/IOS-XE Examples

IKEv2 route-based VPN with VTI:

crypto ikev2 proposal IKEV2-PROP
 encryption aes-gcm-256
 prf sha256
 group 14
!
crypto ikev2 policy IKEV2-POLICY
 proposal IKEV2-PROP
!
crypto ikev2 keyring SITE-B
 peer SITE-B
  address 198.51.100.2
  pre-shared-key ExampleStrongSecret
!
crypto ikev2 profile SITE-B
 match identity remote address 198.51.100.2 255.255.255.255
 authentication remote pre-share
 authentication local pre-share
 keyring local SITE-B
!
crypto ipsec transform-set TS esp-gcm 256
 mode tunnel
!
crypto ipsec profile IPSEC-SITE-B
 set transform-set TS
 set ikev2-profile SITE-B
!
interface Tunnel10
 description IPsec VTI to SITE-B
 ip address 169.254.10.1 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 198.51.100.2
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile IPSEC-SITE-B
!
ip route 10.20.0.0 255.255.0.0 Tunnel10

Notes:

• Use real, private tunnel addressing and real peer IPs. Documentation addresses are examples only.
• Prefer certificates or managed key rotation for high-value tunnels.
• If the peer is behind NAT, verify NAT-T and identity matching.
• If using dynamic routing over the VTI, protect the routing protocol too.

Troubleshooting

Commands

show crypto ikev2 sa
show crypto ikev2 session detail
show crypto ipsec sa
show crypto ipsec profile
show interface Tunnel10
show ip route 10.20.0.0
show access-lists

Expected clues:

• IKE SA is established with the expected peer.
• Child SA has matching local and remote selectors.
• Encaps and decaps counters both increase during test traffic.
• Routes point protected traffic into the tunnel.
• NAT rules do not translate protected traffic unless intentionally designed.
• MTU and MSS avoid fragmentation problems.

Watch Out

• Do not build new VPNs with DES, 3DES, MD5, SHA-1, or weak DH groups unless forced by legacy constraints.
• Do not assume "VPN up" means routes are correct.
• Do not forget NAT exemption for policy-based VPNs.
• Do not ignore MTU. IPsec overhead is real.
• Do not use one broad PSK across many peers.
• Do not leave debug crypto running during normal operation.

References

• RFC 4301: Security Architecture for IP
• RFC 4303: IP Encapsulating Security Payload
• RFC 7296: IKEv2
• RFC 3947: NAT-Traversal in IKE
• RFC 3948: UDP Encapsulation of IPsec ESP Packets
• Cisco IOS XE IPsec Virtual Tunnel Interfaces