IPsec is the IETF standard for VPNs: IKE negotiates keys, ESP encrypts the traffic.

How it works (step by step)

1. Initiation: peer sends IKE-init (UDP 500)
2. Key exchange: Diffie-Hellman generates a shared secret
3. IPsec SA created: transform set is selected (AES, SHA…)
4. Normal operation: ESP packets encrypt the traffic
5. Recovery (CCNP): Dead Peer Detection (DPD), rekey before lifetime expiry

Configuration

Basic IPsec (CCNA – ISAKMP policy + crypto map)

crypto isakmp policy 10
 encryption aes
 hash sha
 authentication pre-share
 group 14
!
crypto isakmp key cisco address 2.2.2.2
!
crypto ipsec transform-set MYSET esp-aes esp-sha-hmac
!
crypto map MYMAP 10 ipsec-isakmp
 set peer 2.2.2.2
 set transform-set MYSET
 match address 101
!
interface g0/0
 crypto map MYMAP

Advanced (CCNP – tunnel protection / VTI)

crypto ikev2 proposal MYPROP
 encryption aes-cbc-256
 integrity sha256
 group 14
!
interface Tunnel0
 tunnel protection ipsec profile MYPROFILE

Design & best practices

• Use IKEv2 (not IKEv1) · use AES-256 · avoid AH
• Use route-based VPN (VTI) instead of crypto maps
• Consider DMVPN for many sites

Dependencies & considerations

• Requires correct routing
• NAT can break IPsec → use NAT-T (UDP 4500)
• MTU problems (fragmentation) and CPU load from encryption
• Certificate infrastructure (PKI) when using certs
• IPv4 vs IPv6: IPsec is built into IPv6 (mandatory support, not mandatory use)

Advanced features (CCNP)

• DMVPN (mGRE + NHRP + IPsec) · GETVPN (group encryption) · FlexVPN · route-based VPN (VTI) vs policy-based VPN · IPsec profiles

Troubleshooting

Symptom	Cause	Solution
Tunnel won’t establish	IKE policy mismatch	Check encryption/hash
Traffic doesn’t pass	ACL mismatch	Check interesting traffic
Phase 2 fail	Transform-set mismatch	Match ESP settings
Rekey loop	Lifetime mismatch	Adjust timers

show crypto isakmp sa
show crypto ipsec sa
debug crypto ikev2

Quick summary

• VPN = encrypted tunnel · IPsec is the standard · IKE does the key exchange · GRE over IPsec carries routing · CCNP = design + troubleshooting