IPsec VPN Builder
Build a site-to-site IPsec VPN the CCNA way: pick the right VPN type, sort authentication / encryption / integrity / key exchange, order the IOS configuration steps, walk the actual commands, and follow a packet through the encrypted tunnel. Content follows the WAN, VPN & GRE guide.
About this lab
Build a site-to-site IPsec VPN the CCNA way: pick the right VPN type, sort authentication / encryption / integrity / key exchange, order the IOS configuration steps, walk the actual commands, and follow a packet through the encrypted tunnel. Content follows the WAN, VPN & GRE guide.
The lab topology
Two sites, each with a router on the Internet. Everything in this activity — the config walkthrough, the packet flow, the quiz — uses this same network.
Why this matters
Two sites, each with a router on the Internet. Everything in this activity — the config walkthrough, the packet flow, the quiz — uses this same network.
Four jobs IPsec does
Authentication
Verifies identity. Pre-shared key in simple labs; certificates when it must scale.
Encryption
Hides the data. AES is the modern choice — DES and 3DES are legacy/weak.
Integrity
Detects tampering. SHA / HMAC-SHA proves the packet was not changed in transit.
Key exchange
Diffie-Hellman derives shared keying material over an insecure channel. It is not data encryption.
Protocol recognition
CCNA asks you to recognize what each piece does — not configure every option.
| Piece | What it does |
|---|---|
| IKE | Negotiates security associations and keys (Phase 1 builds the management channel) |
| ESP | Encrypts the payload; can also provide authentication/integrity |
| AH | Authentication and integrity only — no encryption (recognition-level) |
| Tunnel mode | New outer IP header with the routers' public IPs — the site-to-site default |
| Transport mode | Original IP header stays visible — host-to-host when the endpoints are the VPN peers |
Know your VPN types
Site-to-site IPsec VPN
Connects: Two networks — router/firewall to router/firewall
Use case: Branch office to HQ over the Internet
- Transparent to end hosts — PCs send normal IP traffic
- Tunnel endpoints encrypt/decrypt at the site edge
- Cheaper than dedicated private WAN links for most branches
Remote-access VPN
Connects: One user/device to a network
Use case: Work-from-home laptop reaching company resources
- Client software (e.g. AnyConnect) or browser SSL/TLS
- Terminates on a concentrator/firewall at HQ
- Serves a single end device, built on demand
GRE over IPsec
Connects: Two networks, with a GRE tunnel inside IPsec
Use case: OSPF/EIGRP or multicast must cross an encrypted tunnel
- GRE carries multicast/broadcast and multiple L3 protocols
- IPsec provides the encryption GRE lacks
- Standard IPsec alone is unicast-only — no routing-protocol hellos
Plain GRE
Connects: Two routers with a virtual point-to-point tunnel
Use case: Tunneling where encryption is not required
- No encryption or authentication — clear text
- Never carry sensitive traffic over the Internet with GRE alone
- Pair with IPsec on untrusted paths
IPsec (the framework)
Connects: Protects IP traffic — used by both designs above
Use case: Security layer for site-to-site and client VPNs
- Authentication, encryption, integrity, and key exchange
- IKE negotiates; ESP encrypts; AH authenticates without encryption
- Tunnel mode for site-to-site; transport mode is host-to-host