Cisco IOS Site-to-Site IPSec VPN

Cisco IOS / IOS-XEAdvanced

IKEv1 or IKEv2 site-to-site IPSec VPN tunnel between two Cisco IOS/IOS-XE routers. Generates crypto policy, keyring, profile, transform-set, ACL, and crypto map.

↓ example.txt

What is it?

IPSec VPN creates an encrypted tunnel between two sites over the public internet. IPSec uses two phases: Phase 1 (IKE) negotiates a secure channel to protect Phase 2. Phase 2 (IPSec) establishes the actual data tunnel. IKEv2 (recommended) is faster, more reliable, and supports features like MOBIKE for mobile clients. The 'interesting traffic' ACL defines which traffic triggers the tunnel — typically the local LAN accessing the remote LAN.

✓ When to use

·Site-to-site connectivity between two offices over the internet
·Connecting a branch office to HQ without paying for MPLS circuits
·Disaster Recovery connectivity between primary and backup data centers
·Connecting to cloud providers (AWS, Azure) via VPN Gateway
·Partner/vendor connectivity for specific application traffic

✗ When NOT to use

·Remote access VPN for individual users — use AnyConnect (SSL VPN) instead, much easier for end users
·High-bandwidth real-time traffic (video production) — VPN encryption adds latency and overhead
·When SD-WAN is already deployed — SD-WAN typically manages its own overlay tunnels

How it compares

vs MPLSMPLS is a private carrier circuit — no encryption needed, guaranteed bandwidth, but expensive. IPSec VPN uses the public internet — requires encryption, bandwidth is best-effort, but much cheaper. Many organizations replace MPLS with IPSec + SD-WAN.

vs SSL VPN (AnyConnect)SSL VPN is for individual remote users connecting from laptops/phones. IPSec site-to-site is for connecting entire office networks. Different use cases.

vs GRE tunnelGRE is an unencrypted tunnel — it encapsulates traffic but doesn't protect it. IPSec encrypts. Often combined: GRE over IPSec provides both routing protocol support and encryption.

Prerequisites

→Public IP address on both ends (or NAT traversal configured if behind NAT)
→Pre-shared key agreed upon between both sites (use certificates for production)
→Crypto policy parameters must match exactly on both ends (encryption, hash, DH group)
→Internet connectivity with UDP 500 and UDP 4500 (NAT-T) open between peers
→ACL defining interesting traffic — must be mirror images on both sides

Config Generator

Hostname *

IKE Version

Remote Peer IP *

Local WAN Interface *

Pre-Shared Key *

IKE Encryption

IKE Integrity

IKE DH Group

ESP Encryption

ESP Integrity

IKE SA Lifetime (sec)

IPSec SA Lifetime (sec)

Transform-set Name

Crypto Map Name

Crypto Map Sequence

Crypto ACL Name

Interesting Traffic (Crypto ACL)

PFS Group

Verification commands

show crypto ikev2 sa

Verify IKEv2 Phase 1 is established

Expected: Shows SA state as 'READY'. If empty, Phase 1 never completed.

show crypto ipsec sa

Verify IPSec Phase 2 tunnels and packet counts

Expected: Shows 'pkts encaps' and 'pkts decaps' incrementing. If they're zero, traffic isn't hitting the tunnel.

show crypto map

Show crypto map configuration and which interfaces it's applied to

Expected: Shows the ACL, peer, and transform-set for each crypto map entry

Debug commands

debug crypto ikev2 error

Debug IKEv2 Phase 1 negotiation errors

⚠ Moderate output. Check for mismatched proposals or PSK errors. Run 'undebug all' after.

debug crypto ipsec error

Debug Phase 2 errors — transform-set mismatches, PFS issues

⚠ Use during maintenance window only.

Common mistakes & fixes

⚡ IKEv2 SA not establishing — 'INIT_SA_SENT' never completes

Cause: UDP 500 blocked by firewall, wrong peer IP, or proposal mismatch

Fix: Test connectivity: 'ping <peer-ip>'. Verify both sides use the same IKEv2 proposal (encryption, hash, DH group). Check firewall allows UDP 500 and 4500.

⚡ Phase 1 up but Phase 2 not establishing

Cause: Transform-set mismatch or crypto ACL not mirrored correctly

Fix: Verify transform-set matches on both ends. Check crypto ACL: local side should be 'permit ip LOCAL_NET WILD REMOTE_NET WILD', remote side should be the exact inverse.

⚡ Tunnel up but traffic not passing

Cause: Missing return route or NAT intercepting VPN traffic before encryption

Fix: Add static route to remote subnet via the tunnel. If NAT is configured, add a NAT exemption ACL so VPN traffic is NOT translated.

⚡ VPN drops periodically

Cause: IKE lifetime mismatch causing renegotiation failure, or DPD (Dead Peer Detection) timeout

Fix: Match lifetime on both ends. Check DPD: 'show crypto ikev2 sa detail'. Ensure both peers are reachable at all times.