Security

IPsec VPN Builder

Build a site-to-site IPsec VPN the CCNA way: pick the right VPN type, sort authentication / encryption / integrity / key exchange, order the IOS configuration steps, walk the actual commands, and follow a packet through the encrypted tunnel. Content follows the WAN, VPN & GRE guide.

About this lab

Build a site-to-site IPsec VPN the CCNA way: pick the right VPN type, sort authentication / encryption / integrity / key exchange, order the IOS configuration steps, walk the actual commands, and follow a packet through the encrypted tunnel. Content follows the WAN, VPN & GRE guide.

The lab topology

Two sites, each with a router on the Internet. Everything in this activity — the config walkthrough, the packet flow, the quiz — uses this same network.

Why this matters

Two sites, each with a router on the Internet. Everything in this activity — the config walkthrough, the packet flow, the quiz — uses this same network.

IPsec tunnel Site A LAN192.168.10.0/24PC .25RAVPN endpoint198.51.100.1outside G0/0InternetuntrustedRBVPN endpoint203.0.113.1outside G0/0Site B LAN192.168.20.0/24Server .10

Four jobs IPsec does

Authentication

Verifies identity. Pre-shared key in simple labs; certificates when it must scale.

Encryption

Hides the data. AES is the modern choice — DES and 3DES are legacy/weak.

Integrity

Detects tampering. SHA / HMAC-SHA proves the packet was not changed in transit.

Key exchange

Diffie-Hellman derives shared keying material over an insecure channel. It is not data encryption.

Protocol recognition

CCNA asks you to recognize what each piece does — not configure every option.

PieceWhat it does
IKENegotiates security associations and keys (Phase 1 builds the management channel)
ESPEncrypts the payload; can also provide authentication/integrity
AHAuthentication and integrity only — no encryption (recognition-level)
Tunnel modeNew outer IP header with the routers' public IPs — the site-to-site default
Transport modeOriginal IP header stays visible — host-to-host when the endpoints are the VPN peers

Know your VPN types

Site-to-site IPsec VPN

Connects: Two networks — router/firewall to router/firewall

Use case: Branch office to HQ over the Internet

  • Transparent to end hosts — PCs send normal IP traffic
  • Tunnel endpoints encrypt/decrypt at the site edge
  • Cheaper than dedicated private WAN links for most branches

Remote-access VPN

Connects: One user/device to a network

Use case: Work-from-home laptop reaching company resources

  • Client software (e.g. AnyConnect) or browser SSL/TLS
  • Terminates on a concentrator/firewall at HQ
  • Serves a single end device, built on demand

GRE over IPsec

Connects: Two networks, with a GRE tunnel inside IPsec

Use case: OSPF/EIGRP or multicast must cross an encrypted tunnel

  • GRE carries multicast/broadcast and multiple L3 protocols
  • IPsec provides the encryption GRE lacks
  • Standard IPsec alone is unicast-only — no routing-protocol hellos

Plain GRE

Connects: Two routers with a virtual point-to-point tunnel

Use case: Tunneling where encryption is not required

  • No encryption or authentication — clear text
  • Never carry sensitive traffic over the Internet with GRE alone
  • Pair with IPsec on untrusted paths

IPsec (the framework)

Connects: Protects IP traffic — used by both designs above

Use case: Security layer for site-to-site and client VPNs

  • Authentication, encryption, integrity, and key exchange
  • IKE negotiates; ESP encrypts; AH authenticates without encryption
  • Tunnel mode for site-to-site; transport mode is host-to-host
Section 1 of 8