Overlay VPNs — DMVPN & FlexVPN

Three generations of Cisco multipoint VPN, all built from the same bricks (mGRE + IPsec + a smart control plane): DMVPN mGRE one interface, infinite spokes; NHRP maps tunnel IPs to real WAN IPs; IPsec encrypts per-tunnel via tunnel protection ipsec profile. Phase 1 hub-and-spoke, phase 2 spoke-to-spoke on demand, phase 3 NHRP redirect/shortcut — […]

IPsec — ESP, IKE & Tunnel Mode

Layer 3 crypto suite: ESP (protocol 50) encrypts+authenticates — AH (51, auth only) is legacy; “see IPsec, think ESP”. Two phases Phase 1 (IKE, UDP 500): negotiate encryption/hash/DH group/auth (PSK or certs) → IKE SA. Diffie-Hellman shares a secret without ever sending it (that’s the mod-p exponentiation trick). Phase 2: negotiate ESP transform-set, lifetimes → […]

VPN Types — Site-to-Site, Remote Access, GRE, NAT-T

Site-to-site: router↔router, permanent tunnel between offices. Remote access: client↔gateway, often SSL/TLS. GRE over IPsec when you need routing protocols or multicast that plain policy-based IPsec won’t carry. GRE is not encryption GRE only encapsulates (protocol 47) — readable payload, no integrity, no auth. “GRE tunnel over the internet” = exposed data. GRE’s value: multicast + […]