! PermitANY — Cisco IOS Site-to-Site IPSec VPN
! IKEv1 or IKEv2 site-to-site IPSec VPN tunnel between two Cisco IOS/IOS-XE routers. Generates crypto policy, keyring, profile, transform-set, ACL, and crypto map.
! Generated: 2026-09-20
! These are EXAMPLE values. Replace with your actual config before deploying.
!
hostname RTR-HQ-01
!
! ── Crypto ACL ───────────────────────────────────────────────────────
ip access-list extended ACL-CRYPTO-VPN

 permit ip 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255

!

! ── IKEv2 Proposal + Policy ─────────────────────────────────────────
crypto ikev2 proposal IKEv2-PROPOSAL
 encryption aes 256
 integrity sha512
 group 20
!
crypto ikev2 policy IKEv2-POLICY
 proposal IKEv2-PROPOSAL
!
crypto ikev2 keyring IKEv2-KEYRING
 peer REMOTE-PEER
  address 203.0.113.2
  pre-shared-key local MySecretKey123!
  pre-shared-key remote MySecretKey123!
!
crypto ikev2 profile IKEv2-PROFILE
 match identity remote address 203.0.113.2 255.255.255.255
 authentication remote pre-share
 authentication local pre-share
 keyring local IKEv2-KEYRING
 lifetime 86400
!

! ── IPSec Transform-Set ─────────────────────────────────────────────
crypto ipsec transform-set TS-AES256-SHA512 esp-aes 256 esp-sha512-hmac
 mode tunnel
!
crypto ipsec security-association lifetime seconds 3600
!
! ── Crypto Map ──────────────────────────────────────────────────────
crypto map CMAP-VPN 10 ipsec-isakmp
 description VPN to 203.0.113.2
 set peer 203.0.113.2
 set transform-set TS-AES256-SHA512

 set ikev2-profile IKEv2-PROFILE


 set pfs group20

 match address ACL-CRYPTO-VPN
!
! ── Apply to WAN Interface ──────────────────────────────────────────
interface GigabitEthernet0/0
 crypto map CMAP-VPN
!