Site-to-site VPN technologies: GRE over IPsec for simple tunnels, DMVPN for dynamic multipoint, FlexVPN for modern IKEv2 designs.
Design comparison
| Technology | Encryption | Routing | Scalability | Primary use |
|---|---|---|---|---|
| GRE over IPsec | ✔ | ✔ | Medium | Site-to-site |
| DMVPN | ✔ | ✔ | High | Multi-branch |
| MPLS VPN | ❌ | ✔ | Very high | Service provider |
| SSL VPN | ✔ | Limited | High | Remote access |
| FlexVPN | ✔ | ✔ | High | Modern IPsec |
GRE over IPsec
GRE (IP protocol 47) provides routing/multicast support; IPsec ESP (proto 50 / UDP 4500 with NAT-T) provides encryption. GRE tunnel + IPsec transport mode.
- ✔ Dynamic routing protocols, multicast, full encryption, simple architecture
- ❌ Poor scaling (one tunnel per peer), linear config growth, double overhead, manual peer config
interface Tunnel0
ip address 10.10.10.1 255.255.255.252
tunnel source GigabitEthernet0/0
tunnel destination 2.2.2.2
crypto isakmp policy 10
encryption aes
hash sha256
authentication pre-share
group 14
lifetime 86400
crypto isakmp key cisco address 2.2.2.2
crypto ipsec transform-set GRE-SET esp-aes256 esp-sha-hmac
mode transport
crypto map GRE-MAP 10 ipsec-isakmp
set peer 2.2.2.2
set transform-set GRE-SET
match address 101
access-list 101 permit gre host 1.1.1.1 host 2.2.2.2
interface GigabitEthernet0/0
crypto map GRE-MAPDMVPN (Dynamic Multipoint VPN)
Combines mGRE (overlay), NHRP (control plane – next-hop resolution) and IPsec (encryption). Phases 1/2/3; routing via EIGRP/OSPF/BGP; HA via dual hub. CCNP focus: phase 3 + redirect.
- ✔ Dynamic spoke-to-spoke tunnels, high scalability, supports routing, less hub load (phase 2/3), ideal for many branches
- ❌ Complex troubleshooting, recursive-routing problems, needs correct NHRP design, older technology
Hub:
interface Tunnel0
ip address 10.0.0.1 255.255.255.0
no ip redirects
ip nhrp authentication DMVPNKEY
ip nhrp map multicast dynamic
ip nhrp network-id 1
tunnel source GigabitEthernet0/0
tunnel mode gre multipoint
tunnel key 100
tunnel protection ipsec profile DMVPN-PROFILESpoke:
interface Tunnel0
ip address 10.0.0.2 255.255.255.0
ip nhrp authentication DMVPNKEY
ip nhrp network-id 1
ip nhrp map 10.0.0.1 1.1.1.1
ip nhrp map multicast 1.1.1.1
ip nhrp nhs 10.0.0.1
tunnel source GigabitEthernet0/0
tunnel mode gre multipoint
tunnel key 100
tunnel protection ipsec profile DMVPN-PROFILEFlexVPN
IKEv2-based, route-based IPsec using VTI; supports hub/spoke/mesh; PSK or certificates; NAT supported. The modern IPsec design.
crypto ikev2 proposal FLEX-PROP
encryption aes-cbc-256
integrity sha256
group 14
crypto ikev2 policy FLEX-POLICY
proposal FLEX-PROP
crypto ikev2 keyring FLEX-KEYRING
peer SPOKE
address 2.2.2.2
pre-shared-key cisco123
crypto ikev2 profile FLEX-PROFILE
match identity remote address 2.2.2.2 255.255.255.255
authentication local pre-share
authentication remote pre-share
keyring local FLEX-KEYRING
crypto ipsec transform-set FLEX-SET esp-aes256 esp-sha256-hmac
crypto ipsec profile FLEX-IPSEC
set transform-set FLEX-SET
set ikev2-profile FLEX-PROFILE
interface Tunnel10
ip address 10.10.10.1 255.255.255.252
tunnel source GigabitEthernet0/0
tunnel destination 2.2.2.2
tunnel mode ipsec ipv4
tunnel protection ipsec profile FLEX-IPSEC- ✔ IKEv2, route-based VTI, scalable, simpler than crypto maps, site-to-site + remote access, better HA
- ❌ Needs newer software, less widespread than DMVPN, complex at first
MPLS L3 VPN & SSL VPN (design perspective)
- MPLS VPN: very high scalability, provider handles the core, no customer tunnel config, VRF isolation – but no encryption (segmentation only), expensive
- SSL/TLS VPN: uses TCP 443 (passes firewalls), user friendly, ideal remote access + MFA – but not for site-to-site routing
| Technology | Primary strength | Primary weakness |
|---|---|---|
| GRE over IPsec | Simple routing VPN | Scales badly |
| DMVPN | Scalable branch solution | Complexity |
| MPLS VPN | Carrier-grade stability | No encryption |
| SSL VPN | Remote-access reliability | No routing |
| FlexVPN | Modern flexible IPsec | Less widespread |