# Site-to-Site VPN and IPSec

> Chapter 13 of the Courseiva ENARSI curriculum — https://courseiva.com/learn/enarsi/site-to-site-vpn-and-ipsec

**Official objective:** 2.4 — Configure and verify site-to-site VPN with IPsec

## Introduction

Exam objective 2.4 for the 300-410 ENARSI exam demands you can configure and verify site-to-site VPN with IPSec. This technology solves a fundamental business problem: how to connect two separate office networks securely across the public internet without leasing an expensive private cable. For your exam, you must understand not just that VPNs work, but exactly which knob to turn and what command to type to make them work safely.

## The Diplomatic Pouch and Embassy Tunnel Analogy

An embassy is a physical building in a foreign country that legally belongs to its home country.

Two embassies, one in London and one in Paris, need to exchange secret documents every day. They cannot use the public postal service because letters could be opened, read, or tampered with. Instead, they build a dedicated, secure tunnel between the two embassy buildings, running deep underground. This tunnel is the VPN. Before any document goes into the tunnel, the sender seals it inside a special diplomatic pouch that is locked with a unique padlock. The receiver has the only key that opens that exact padlock. This sealing is IPSec encryption. The pouch also has a tamper-proof seal that breaks if anyone tries to open it along the way. That is IPSec integrity. When the pouch arrives, the receiver verifies the seal is intact and unlocks it. This entire process – the tunnel, the locked pouch, the tamper seal, and the key exchange to set up those locks – maps exactly to a site-to-site VPN with IPSec. The tunnel provides a private path across a public internet, just as the digging created a private corridor across foreign soil. The locking and sealing ensure that even if the tunnel were breached, the contents remain confidential and unchanged.

## Core explanation

A site-to-site VPN creates a secure tunnel between two routers located in different physical locations, such as a headquarters office and a branch office. Imagine the internet as a public road. Anyone can travel it, and anyone can look at what you are carrying if you do not protect it. A site-to-site VPN builds a private, sealed tube through that public road so that traffic between the two offices never touches the open air.

The technology that builds this tube is called IPSec, which stands for Internet Protocol Security. IPSec is not a single tool; it is a suite of protocols that work together. It provides three essential guarantees: confidentiality, meaning no one can read your data; integrity, meaning no one can change your data; and authentication, meaning you know you are talking to the correct device, not an imposter.

To achieve these guarantees, IPSec uses two main protocols: Authentication Header (AH) and Encapsulating Security Payload (ESP). AH provides authentication and integrity but does not encrypt the data. ESP provides encryption, which scrambles the data, plus authentication and integrity. In practice, ESP is almost always used because encryption is the main reason to deploy a VPN.

IPSec can operate in two modes: transport mode and tunnel mode. Transport mode only encrypts the payload of the packet, leaving the original IP header visible. This mode is typically used for end-to-end connections between individual computers. Tunnel mode encrypts the entire original packet, including its IP header, and then wraps it in a new IP header. This is the mode used for site-to-site VPNs because it hides the internal addressing structure of each office network from the public internet.

The process of setting up an IPSec tunnel involves two phases. Phase 1 establishes a secure management channel between the two routers. Think of it as the two routers introducing themselves, agreeing on a secret language, and proving their identities using a pre-shared key or digital certificates. This phase uses the Internet Key Exchange (IKE) protocol. Once phase 1 completes, the routers have a secure tunnel they can use to negotiate further details.

Phase 2 then negotiates the actual data tunnel that will carry user traffic. Here, the routers agree on which encryption algorithm to use, such as AES (Advanced Encryption Standard), and which integrity algorithm, such as SHA (Secure Hash Algorithm). They also agree on a shared secret key for encrypting the data itself. This second set of keys is called the IPSec Security Association (SA). The SA is unidirectional, meaning one SA is created for traffic going from HQ to branch, and another for traffic from branch to HQ.

Once both phases complete, the tunnel is up. Traffic flowing from one site to the other is encrypted by the sending router, sent across the internet inside the tunnel, and decrypted by the receiving router. The internal network devices, like laptops and servers, have no idea the VPN exists. They send packets to their default gateway as usual, and the router handles all the encryption and decryption automatically.

For the 300-410 exam, you need to know the specific commands to configure each part. The 'crypto isakmp policy' command configures phase 1 parameters. The 'crypto ipsec transform-set' command defines the encryption and integrity algorithms for phase 2. The 'crypto map' command binds everything together and applies it to the outgoing interface on the router. Verification is done using 'show crypto isakmp sa' to see the phase 1 tunnel status and 'show crypto ipsec sa' to see the phase 2 data tunnel status and packet statistics.

## Real-world context

A medium-sized company called "DataVault" has two offices: a headquarters in London and a branch office in Manchester. Each office has its own local network with servers, printers, and about fifty workstations. The company uses a cloud-based inventory system hosted on a server in the London office. The Manchester staff need to access this inventory system as if they were sitting right next to it.

The IT administrator, Alex, is tasked with connecting the two networks. The obvious solution is to buy a dedicated leased line from a telecommunications provider, but this costs thousands of pounds per month. Instead, Alex decides to use a site-to-site VPN over the existing business broadband connections at each site. Each office has a Cisco router that connects to the internet. Alex configures both routers with an IPSec VPN.

Here is the step-by-step walkthrough of what Alex actually does:

- Alex logs into the London router via SSH and enters global configuration mode.
- He creates an ISAKMP policy for phase 1. He sets the encryption to AES-256 and the authentication to a pre-shared key. The pre-shared key is a long, complex string that both routers must know.
- He configures the IP address of the remote router (the Manchester router's public IP) as the peer for the VPN.
- He defines a transform set for phase 2 that uses ESP with AES-256 for encryption and SHA-512 for integrity.
- He creates an access list that identifies which traffic should be encrypted. This is a critical step: if the access list is wrong, traffic that should be encrypted might be sent in the clear, or traffic that should be sent in the clear might be encrypted and dropped. Alex's access list says: permit IP traffic from the London subnet (10.1.1.0/24) to the Manchester subnet (10.2.2.0/24).
- He creates a crypto map that ties together the peer, the transform set, and the access list. He applies this crypto map to the external interface of the London router (typically the interface facing the internet).
- He repeats a mirrored configuration on the Manchester router: the peer is the London public IP, and the access list permits traffic from the Manchester subnet to the London subnet.
- He saves the configuration and then tests by pinging a device in Manchester from a workstation in London. The ping succeeds, proving the tunnel is working.

Alex then monitors the tunnel using 'show crypto ipsec sa'. He looks at the packet counters: the 'encaps' counter shows packets sent into the tunnel, and the 'decaps' counter shows packets received and decrypted. If those counters are incrementing, the tunnel is passing traffic. He also checks for 'pkts encaps failed' — if that number is non-zero, something is wrong with the configuration, likely the access list or the crypto map not being applied correctly.

Common real-world complications Alex might face include: dynamic public IP addresses at one or both sites, which require using dynamic DNS or a VPN technology called DMVPN (Dynamic Multipoint VPN); firewalls blocking the IKE traffic on UDP port 500 and ESP traffic on IP protocol 50; and MTU (Maximum Transmission Unit) issues where the extra encryption headers cause packets to exceed the maximum size allowed on the internet path, leading to fragmentation or drops. Alex handles these by checking firewall rules, adjusting the MTU on the tunnel interface, and enabling IPsec fragmentation before encryption.

## Exam focus

The 300-410 exam tests your ability to configure and verify site-to-site VPN with IPSec in a simulated Cisco environment. You will not be asked to design a VPN strategy from scratch. Instead, you will be given a partial configuration and asked to identify the missing command, the incorrect parameter, or the reason a tunnel is not forming.

The most tested concept is the 'crypto map' and its application to the correct interface. A favourite trap is showing a crypto map that is correctly defined but never applied to the interface. The question will describe a scenario where the tunnel never comes up, and the correct answer will point out that the 'crypto map map-name' command is missing from the interface configuration.

- Exam topics you must memorise:
- The five ISAKMP policy parameters: encryption algorithm, hash algorithm, authentication method, Diffie-Hellman group, and lifetime. The default values are tested often.
- The difference between pre-shared key authentication and certificate-based authentication. Certificates are more secure but more complex to manage.
- The requirement that both peers must have matching phase 1 policies. If one side uses AES-256 and the other side uses AES-128, phase 1 will fail.
- Transform set: match exactly on both sides for encryption and integrity algorithms.
- The crypto map must be applied to the outgoing interface – not a loopback, not a VLAN interface.

- Trap patterns to watch for:
- The question states 'the tunnel is up but no traffic passes'. The cause is often a misconfigured access list that does not match the actual traffic. For example, the access list permits traffic from subnet A to subnet B, but the actual traffic originates from subnet C.
- The question states 'phase 1 is complete but phase 2 never finishes'. The cause is often a mismatched transform set or an ACL that is too restrictive or missing on one side.
- The question uses 'crypto isakmp key' missing the 'address' keyword. The correct syntax is 'crypto isakmp key key-string address peer-ip'. Omitting 'address' is a common mistake in multiple-choice answers.

- Key definitions to memorise for the exam:
- SA (Security Association): a set of parameters that define how the tunnel treats a specific type of traffic.
- IKE (Internet Key Exchange): the protocol used to negotiate the SA parameters.
- Diffie-Hellman: a method for two parties to securely agree on a shared secret key over an untrusted network. The group number (1, 2, 5, 14, etc.) determines the key strength.
- Perfect Forward Secrecy (PFS): a feature that ensures if one session key is compromised, previous and future session keys remain secure. It requires an additional Diffie-Hellman exchange during phase 2.

You will also see simulation questions where you must type the commands. Practise the exact syntax. For example, the command to define a transform set is 'crypto ipsec transform-set name encryption-type integrity-type', such as 'crypto ipsec transform-set DATAVAULT esp-aes 256 esp-sha-hmac'. If you type 'sha' instead of 'esp-sha-hmac', the command will be rejected in the simulator. Memorise the keyword 'esp-sha-hmac' and 'esp-aes 256'.

## Step by step

1. **Define the IKE Phase 1 Policy** — Use 'crypto isakmp policy priority' to set the encryption algorithm (e.g., aes 256), hash algorithm (e.g., sha), authentication method (e.g., pre-share), and Diffie-Hellman group (e.g., 14). This policy defines how the two routers will securely introduce themselves to each other.
2. **Configure the Pre-Shared Key** — Use 'crypto isakmp key key-string address peer-ip' to set a shared secret that both routers will use to prove their identities during phase 1. The key must match exactly on both sides, and the peer IP address must be correct.
3. **Define the IPSec Transform Set** — Use 'crypto ipsec transform-set name encryption-type integrity-type' to specify how data packets will be encrypted and authenticated in phase 2. For example, 'esp-aes 256' and 'esp-sha-hmac' are common choices.
4. **Create the Access List for Interesting Traffic** — Use 'access-list number permit ip source subnet wildcard destination subnet wildcard' to define which traffic should be encrypted. Only traffic matching this list will trigger the VPN tunnel.
5. **Create and Apply the Crypto Map** — Use 'crypto map map-name priority ipsec-isakmp' to combine the peer IP, the transform set, and the access list. Then apply the crypto map to the outgoing interface from interface configuration mode with 'crypto map map-name'. This final step activates the VPN on the physical interface.

## Comparisons

### IKE Phase 1 vs IKE Phase 2

**IKE Phase 1:**
- Establishes a secure management channel
- Uses ISAKMP policy with parameters like encryption, hash, DH group
- Also called the Internet Key Exchange (IKE) SA

**IKE Phase 2:**
- Establishes the data encryption tunnel
- Uses transform sets with encryption and integrity algorithms
- Also called the IPSec SA; unidirectional, so two are created per tunnel

### IPSec Transport Mode vs IPSec Tunnel Mode

**IPSec Transport Mode:**
- Encrypts only the payload of the packet
- Original IP header remains visible
- Used for host-to-host communication (e.g., between two servers)

**IPSec Tunnel Mode:**
- Encrypts the entire original packet including IP header
- Adds a new IP header
- Used for site-to-site VPNs and gateway-to-gateway scenarios

### Authentication Header (AH) vs Encapsulating Security Payload (ESP)

**Authentication Header (AH):**
- Provides authentication and integrity only
- Does not encrypt the data
- Uses IP protocol 51

**Encapsulating Security Payload (ESP):**
- Provides encryption, authentication, and integrity
- Encrypts the data payload
- Uses IP protocol 50; most common in site-to-site VPNs

### Pre-Shared Key (PSK) vs Certificate-Based Authentication

**Pre-Shared Key (PSK):**
- Uses a shared secret string on both routers
- Simpler to configure initially
- Less scalable; key must be manually distributed to each peer

**Certificate-Based Authentication:**
- Uses digital certificates signed by a Certificate Authority (CA)
- More secure and scalable for many sites
- Requires a PKI infrastructure to manage certificates

### Dynamic Multipoint VPN (DMVPN) vs Standard Site-to-Site IPSec VPN

**Dynamic Multipoint VPN (DMVPN):**
- Supports dynamic IP addresses at branch sites
- Allows spoke-to-spoke tunnels without hub intervention
- Uses mGRE (multipoint GRE) and NHRP (Next Hop Resolution Protocol)

**Standard Site-to-Site IPSec VPN:**
- Requires static IP addresses (or DDNS) on both ends
- Hub must relay all traffic between spokes if multiple sites
- Simpler to configure for a single pair of sites

## Diagram

_Flowchart showing how a site-to-site IPSec VPN connects the London and Manchester networks, with key configuration elements mapped to the London router._

```mermaid
flowchart TD
    A[London HQ Network] -->|Traffic to Manchester| B[London Router]
    B -->|Encrypts with IPSec| C[IPSec Tunnel over Internet]
    C -->|Decrypts| D[Manchester Router]
    D -->|Traffic to HQ| E[Manchester Branch Network]
    F[Isakmp Phase 1: IKE Policy] --> B
    G[Isakmp Phase 2: Transform Set & Crypto Map] --> B
    H[Access List: Permit 10.1.1.0 to 10.2.2.0] --> B
    I[Pre-Shared Key] --> B
    J[Peer IP: Manchester Public IP] --> B
```

## Common misconceptions

- **Misconception:** IPSec VPN encrypts all traffic from the router, including traffic destined for the internet. **Reality:** IPSec VPN only encrypts traffic that matches the access list defined in the crypto map. All other traffic is forwarded normally without encryption. (Beginners assume a VPN encrypts everything because they think of it as a blanket security blanket. The access list is a selective filter – only specific subnets get encrypted.)
- **Misconception:** Both routers must use the exact same pre-shared key and the same ISAKMP policy priority number. **Reality:** The pre-shared key must match, but the ISAKMP policy priority number (e.g., 10, 20) is local to each router and does not need to match. The routers only care that the parameters (encryption, hash, etc.) inside the policy match. (The priority number is just a sequence for trying policies; routers compare the actual parameter values, not the policy number.)
- **Misconception:** A site-to-site VPN requires a static public IP address on both sides to work. **Reality:** While static IPs simplify configuration, site-to-site VPNs can work with dynamic IPs using technologies like Dynamic DNS (DDNS) or DMVPN, which dynamically learn the peer's current IP. (Many home and small business connections use dynamic IPs, so beginners assume VPNs cannot work without static addresses. Dynamic IP support is a common feature in enterprise VPN solutions.)
- **Misconception:** IPSec tunnel mode and transport mode are interchangeable for site-to-site VPNs. **Reality:** Tunnel mode is required for site-to-site VPNs because it encrypts the original IP header. Transport mode leaves the original header visible and is only used for host-to-host communication (e.g., between two servers). (The confusion arises from the similar names. Beginners think both modes can be used interchangeably because both carry IPSec, but the difference in header encapsulation is fundamental.)
- **Misconception:** If the 'show crypto ipsec sa' command shows no output, the tunnel is down and there is a configuration error. **Reality:** No output from 'show crypto ipsec sa' is normal if no traffic has ever matched the VPN access list. The tunnel is established dynamically when interesting traffic triggers it. If traffic never triggers the tunnel, the SA remains null. (Beginners expect the tunnel to always be visible in the output, but IPSec SAs are created on demand. Seeing no output does not necessarily mean a problem – it just means no traffic has tried to use the tunnel yet.)
- **Misconception:** IPSec VPN eliminates all security risks between the two sites because the data is encrypted. **Reality:** IPSec VPN provides encryption, but it does not protect against threats like viruses, malware, or insider attacks at the remote site. It also does not protect against misconfigurations, like forgetting to encrypt traffic to certain subnets. (The name 'security' in IPSec leads beginners to overestimate its capabilities. It only secures the data in transit; endpoint security, firewalls, and antivirus software are still needed.)

## Key takeaways

- IPSec uses two phases: IKE phase 1 sets up a secure management channel, and IKE phase 2 sets up the data encryption tunnel.
- The crypto map is the central configuration object that ties together the peer, the transform set, and the access list to create a working VPN.
- Both routers must have matching ISAKMP policies (encryption, hash, authentication, Diffie-Hellman group) and matching transform sets for the tunnel to form.
- The access list in the crypto map defines which traffic gets encrypted; if the ACL does not match the actual traffic, the tunnel may be up but no data flows.
- Use 'show crypto isakmp sa' to verify phase 1 status and 'show crypto ipsec sa' to verify phase 2 status and packet counters.
- Dynamic IP addresses at one or both sites require additional technologies like DMVPN or Dynamic DNS to maintain a site-to-site VPN.
- Perfect Forward Secrecy (PFS) in phase 2 ensures that compromising one session key does not expose past or future session keys.
- IPSec tunnel mode encrypts the entire original packet (including the IP header) and is required for site-to-site VPNs.
- A common exam trap is that the crypto map must be applied to the outgoing interface – not a loopback or subinterface – for the VPN to function.

## FAQ

**Why is my IPSec tunnel showing 'MM_NO_STATE' when I do 'show crypto isakmp sa'?**

MM_NO_STATE means no phase 1 negotiation has been attempted. This is usually because no interesting traffic has triggered the tunnel, or because the crypto map has not been applied to the correct interface.

**What does the 'transform-set' do in an IPSec VPN?**

A transform-set defines the specific encryption algorithm (like AES) and integrity algorithm (like SHA) that will be used to protect the actual data packets traversing the tunnel. Both sides must use identical transform-sets.

**Can I use the same IP address for the peer in both routers' configurations?**

No. On the London router, the peer IP must be the Manchester router's public IP address. On the Manchester router, the peer IP must be the London router's public IP address. They are different addresses.

**What is the difference between IKE and IPSec in a site-to-site VPN?**

IKE (Internet Key Exchange) is the protocol that sets up the secure control channel and negotiates keys (phase 1 and part of phase 2). IPSec is the protocol that encrypts and authenticates the actual user data packets once the keys are established.

**Why does my tunnel come up but no traffic goes through?**

This is almost always due to an incorrect access list in the crypto map. The access list must match the source and destination subnets exactly. Check both routers' access lists for a mismatch or a missing entry.

**What does 'show crypto ipsec sa' show that 'show crypto isakmp sa' does not?**

'show crypto ipsec sa' shows the phase 2 security associations: the encryption and integrity algorithms in use, packet encapsulation and decapsulation counters, and any errors. 'show crypto isakmp sa' only shows phase 1 status.

**Is it possible to have multiple VPN tunnels on the same router interface?**

Yes. You can configure multiple crypto maps on the same interface by using different crypto map names or different priority numbers within the same crypto map sequence. Each tunnel can have different peers, transform-sets, or access lists.

## Check your understanding

1. **What command would you use to verify if phase 1 of the IPSec VPN has completed successfully?**

   Answer: The command is 'show crypto isakmp sa'. Look for a state of 'QM_IDLE' to indicate phase 1 is complete.

2. **What is the purpose of the access list in a crypto map?**

   Answer: The access list defines which traffic (interesting traffic) should be encrypted and sent through the VPN tunnel. Only packets matching the ACL trigger the tunnel creation.

3. **What does 'transform-set' specify in an IPSec configuration?**

   Answer: A transform-set specifies the encryption algorithm (e.g., AES-256) and the integrity algorithm (e.g., SHA-512) used to protect data during phase 2 of the VPN.

4. **Why does a site-to-site VPN use tunnel mode instead of transport mode?**

   Answer: Tunnel mode encrypts the entire original IP packet including the header, allowing the internal network addresses to be hidden from the internet. Transport mode does not hide the original header and is not suitable for connecting entire networks.

5. **What is a common cause for a phase 2 failure after a successful phase 1 negotiation?**

   Answer: A common cause is a mismatch in the transform set parameters (encryption or integrity algorithms) between the two routers, or one side missing an access list that defines the interesting traffic.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/enarsi/site-to-site-vpn-and-ipsec