VPNs and tunnels

0 of 38 nailed

Core15

What is a VPN, and what is the difference between site-to-site and remote access?
Say this first
A VPN carries private traffic across a network you do not trust, usually the internet, inside a tunnel. The tunnel adds a new outer header so the private addresses can cross the public network, and a security protocol such as IPsec, TLS or WireGuard adds encryption, integrity and peer authentication. Site-to-site joins whole networks: two gateways keep a tunnel up and the hosts behind them do not know it exists. Remote access joins one user device to the company network: a client on the laptop builds the tunnel to a headend, with per-user authentication.
Go deeper
Site-to-site

The tunnel ends on routers or firewalls at each site. Hosts need no software.

Usually IPsec, often as a routed tunnel interface (VTI or GRE over IPsec) so a routing protocol can run across it.

The gateways authenticate each other with pre-shared keys or certificates.

At scale it becomes hub-and-spoke, DMVPN or an SD-WAN overlay.

Remote access

A client on the endpoint: Cisco Secure Client (AnyConnect), GlobalProtect, FortiClient, WireGuard, or the IKEv2 client built into Windows, macOS, iOS and Android.

User authentication through AAA (RADIUS, LDAP, SAML) with MFA, often plus a device posture check.

The headend assigns an inner IP address from a pool and pushes DNS servers and routes.

A split tunnel or full tunnel decision.

Other things called a VPN
An MPLS L3VPN is private by separation (VRFs and labels in the provider core), not by encryption. A consumer "VPN service" is remote access to a provider's internet exit point.
They will ask next
Is an MPLS L3VPN encrypted?
No. Privacy comes from separate routing tables (VRFs) and labels inside the provider network. If the data must be confidential from the provider too, run IPsec over it between the CE routers.

What would you deploy to connect 300 branches?
Something that does not need 300 tunnels typed by hand on the hub: DMVPN, or an SD-WAN overlay with a controller. Both give hub-and-spoke by default with on-demand spoke-to-spoke paths, and a routing protocol or the controller handles reachability.
Traps
Saying a VPN is "just encryption". The tunnel and the inner vs outer addressing are the core idea. Plain GRE is a VPN tunnel with no security at all.
How did you do?Book 3.3 Internet (IP)Book 8.5 Example Systems Own page

What is IPsec, and which security services does it provide?

Say this first

IPsec is a framework of protocols that protects IP packets at the network layer, so every application above it is covered without changes. It provides confidentiality (encryption), integrity, data origin authentication and anti-replay protection. The parts are IKE, which authenticates the peers and agrees keys; ESP (and rarely AH), which protects the packets; and security associations, which record what was agreed for each direction.

Go deeper

Service by service

Service	How IPsec delivers it
Confidentiality	ESP cipher, for example AES
Integrity	HMAC (SHA-256 and up) or an AEAD cipher such as AES-GCM
Origin authentication	Keys only the two authenticated peers know, agreed after a PSK or certificate check in IKE
Anti-replay	ESP sequence numbers checked against a sliding window

Why "framework"

The algorithms are pluggable and negotiated per tunnel: cipher, integrity, Diffie-Hellman group, lifetimes. The architecture is RFC 4301; ESP is RFC 4303; IKEv2 is RFC 7296.

Where you meet it

Site-to-site VPNs, remote-access clients, cloud VPN gateways, and as the authentication method for OSPFv3.

They will ask next

Does IPsec hide that a VPN exists?
No. An observer sees IKE on UDP 500 or 4500 and ESP between the two gateways, plus packet sizes and timing. Tunnel mode hides the inner addresses, ports and payload, nothing more.
Is IPsec mandatory in IPv6?
It was originally a "must implement" for IPv6 nodes. RFC 6434 relaxed that to "should". Using it has always been optional, so IPv6 traffic is not encrypted by default.

Traps

Saying IKE encrypts the user data. IKE negotiates and authenticates; ESP encrypts the data packets.

How did you do?Book 8.5 Example Systems Own page

What is GRE, and how much overhead does it add?
Say this first
GRE (Generic Routing Encapsulation) wraps a packet inside a new IP header so it can cross another network. It is IP protocol 47. The basic GRE header is 4 bytes, so GRE over IPv4 adds 24 bytes: 20 for the new IP header and 4 for GRE. It carries multicast and other protocols, which is why routing protocols run over it, but it has no encryption or authentication of its own.
Go deeper
Header
The basic header holds flags, a version and a protocol type (the EtherType of the payload, 0x0800 for IPv4). Optional fields add 4 bytes each: checksum, key (used to tell tunnels apart) and sequence number. RFC 2784 defines GRE and RFC 2890 adds the key and sequence fields.

Why people use it

Carries multicast and broadcast, so OSPF, EIGRP and PIM work across it.

Carries IPv6 over an IPv4 core, and other payloads.

Gives you a tunnel interface with an IP address that you route into like any link.

IOS basics
Cisco IOS
interface Tunnel0 ip address 172.16.0.1 255.255.255.252 tunnel source GigabitEthernet0/0/0 tunnel destination 203.0.113.2
tunnel mode gre ip is the default. On a 1500-byte underlay the tunnel IP MTU defaults to 1476.

Line protocol
A GRE tunnel interface comes up when the tunnel source is up and the router has a route to the tunnel destination that does not point back into the tunnel. GRE has no handshake, so up/up does not prove the far end is alive.
They will ask next
The tunnel shows up/up but the far router is powered off. Why?
Nothing in GRE checks the far end. Enable keepalive 10 3 on the tunnel interface (10-second period, 3 retries) so the line protocol drops after missed keepalives, or rely on routing protocol hellos across the tunnel to withdraw routes.

What does a firewall need to allow for plain GRE?
IP protocol 47 between the two tunnel endpoints. GRE has no ports, so it is not TCP or UDP, and PAT devices often cannot translate it. Once GRE is protected by IPsec the firewall only sees ESP or UDP 4500.
Traps
Calling GRE secure. It is clear text; anyone on the path can read it and inject packets.
Forgetting the 24 bytes when sizing the tunnel MTU and TCP MSS.
How did you do?Book 3.3 Internet (IP)Own page
Why would you run GRE over IPsec instead of plain IPsec?
Say this first
Classic IPsec with a crypto map only protects unicast IP that matches an ACL. It has no interface to route into and cannot carry routing protocol multicast. GRE provides a real tunnel interface that carries multicast, and IPsec then encrypts the GRE packets. The result is dynamic routing across an encrypted tunnel, and an IPsec policy that is a single rule: GRE between the two public addresses.
Go deeper
How the layers fit

A packet routed into Tunnel0 gets a GRE header and an outer IP header with the public tunnel source and destination.

IPsec protects that GRE packet. The traffic selector is GRE, host to host: local 198.51.100.1/32 protocol 47 to remote 203.0.113.2/32 protocol 47.

Transport mode is the usual choice because GRE already provides the outer header with the right addresses. That saves 20 bytes per packet.

Modern IOS configuration
tunnel protection ipsec profile NAME on the GRE tunnel interface. No crypto map and no crypto ACL to maintain.

When a plain VTI is enough
A static VTI (tunnel mode ipsec ipv4) is also a routed interface and runs routing protocols, with less overhead because there is no GRE header. Choose GRE over IPsec when you need multipoint tunnels (DMVPN), non-IPv4 payloads over one tunnel, or interop with a peer that expects GRE.
They will ask next
Transport or tunnel mode for GRE over IPsec?
Transport. The GRE packet's own IP header already says public address to public address, so tunnel mode would add a second identical header for 20 more bytes. Tunnel mode is needed when the GRE endpoints are not the same addresses as the IPsec endpoints.

What does the proxy ID look like in the show output?
Protocol 47 host to host. show crypto ipsec sa shows local ident (addr/mask/prot/port): (198.51.100.1/255.255.255.255/47/0) and the mirror for the remote address.
Traps
Saying IPsec alone can run OSPF. A crypto map cannot. A VTI can, because it is an interface.
How did you do?Book 8.5 Example Systems Book 3.3 Internet (IP)Own page

What is the difference between AH and ESP?

Say this first

Both protect IP packets. AH (IP protocol 51) gives integrity and origin authentication over the whole packet, including the fields of the outer IP header that do not change in transit, but it does not encrypt. ESP (IP protocol 50) encrypts and authenticates, but its integrity check does not cover the outer IP header. Because AH signs the addresses, any NAT breaks it. Practically every deployment uses ESP.

Go deeper

ESP packet layout

Field	Size
SPI	4 bytes
Sequence number	4 bytes
IV	16 bytes for AES-CBC, 8 for AES-GCM
Payload	the protected packet or segment
Padding	0 to 255 bytes, to fill the cipher block
Pad length and next header	2 bytes
ICV (integrity check)	12 bytes for HMAC-SHA1-96, 16 for HMAC-SHA-256-128 and GCM

Everything from the payload through the next header field is encrypted. The SPI and sequence number are in clear because the receiver needs them to find the SA.

Why AH is rare

No confidentiality.
NAT rewrites the source address, so the AH check fails.
If you ever need integrity without encryption, ESP with a null cipher does that and survives NAT traversal.

They will ask next

Can AH and ESP be used together?
Yes, a transform set can bundle both, which was once done to protect the outer header as well. It adds overhead and NAT problems and gives nothing that ESP with strong integrity does not. I would not deploy it.
Why is AES-GCM preferred for ESP?
It is an AEAD cipher: it encrypts and authenticates in one pass, so there is no separate HMAC. It is fast in hardware and has less overhead (8-byte IV). On IOS it is esp-gcm 256 in the transform set, with no separate integrity transform.

Traps

Saying AH and ESP use port 51 and port 50. They are IP protocol numbers. Only with NAT-T is ESP put inside UDP 4500.
Saying ESP authenticates the entire packet. In tunnel mode it covers the original packet, not the new outer header.

How did you do?Book 8.5 Example Systems Own page

Explain IPsec transport mode versus tunnel mode.
Say this first
Tunnel mode protects the entire original IP packet and puts it behind a new IP header that carries the gateway addresses. Transport mode keeps the original IP header and protects only what follows it. Gateways protecting traffic for other hosts use tunnel mode. Transport mode is for host-to-host protection, or when another protocol such as GRE has already added the outer header.
Go deeper
On the wire
Output
Original: [IP 10.1.0.10 > 10.2.0.20][TCP][data] Tunnel mode: [IP 198.51.100.1 > 203.0.113.2][ESP][IP 10.1.0.10 > 10.2.0.20][TCP][data][trailer][ICV] Transport mode: [IP 10.1.0.10 > 10.2.0.20][ESP][TCP][data][trailer][ICV] GRE over IPsec, transport mode: [IP 198.51.100.1 > 203.0.113.2][ESP][GRE][IP 10.1.0.10 > 10.2.0.20][TCP][data][trailer][ICV]
What changes

Tunnel mode hides the real source and destination; an observer only sees the two gateways.

Transport mode exposes the real addresses but saves 20 bytes.

On IOS a transform set is tunnel mode unless you add mode transport under it.
They will ask next
Which mode does a static VTI use?
Tunnel mode. The outer header carries the tunnel source and destination, and the traffic selectors are any to any.

Why can two gateways not protect their LANs with transport mode?
In transport mode the packet keeps the host addresses as its only IP header. It would be routed to the remote host directly instead of to the remote gateway, which is the only device that can decrypt it. Tunnel mode adds the gateway-to-gateway header that delivers it.
Traps
Saying transport mode does not encrypt the payload. It encrypts everything after the IP header.
How did you do?Book 8.5 Example Systems Own page
Which protocols and ports must a firewall allow for an IPsec VPN to come up?
Say this first
UDP 500 for IKE, and ESP (IP protocol 50) for the data. When NAT traversal is in use, both IKE and ESP move to UDP 4500, so allow that too. AH (IP protocol 51) only if someone really uses AH. If any device in the path does NAT, plan on UDP 500 and UDP 4500 only.
Go deeper
Traffic Protocol and port When
IKEv1 and IKEv2 UDP 500 always, to start
IKE and ESP with NAT-T UDP 4500 NAT detected on the path, or NAT-T forced
ESP IP protocol 50 no NAT on the path
AH IP protocol 51 rare
On an IOS router with an outside ACL
Cisco IOS
ip access-list extended OUTSIDE-IN permit udp host 203.0.113.2 host 198.51.100.1 eq isakmp permit udp host 203.0.113.2 host 198.51.100.1 eq non500-isakmp permit esp host 203.0.113.2 host 198.51.100.1
isakmp is UDP 500 and non500-isakmp is UDP 4500.

GRE inside IPsec
When GRE is protected by IPsec, the firewall never sees protocol 47; it only sees ESP or UDP 4500.
They will ask next
The peers talk on UDP 4500 although you configured no NAT. Why?
Something in the path does NAT: a provider CGNAT, or cloud 1:1 NAT such as a public IP in front of a cloud VM. NAT detection in IKE found that the addresses changed and both sides switched to UDP 4500. That is normal and works, as long as UDP 4500 is allowed.
Traps
Saying "ESP uses port 50". ESP has no ports; it is IP protocol 50.
How did you do?Book 8.5 Example Systems Own page
Walk me through IKE phase 1 and phase 2.
Say this first
Phase 1 builds an authenticated, encrypted control channel between the two gateways, the IKE SA (the ISAKMP SA in IKEv1). They agree on encryption, hash, Diffie-Hellman group, authentication method and lifetime, run Diffie-Hellman and prove their identity with a pre-shared key or a certificate. Phase 2 runs inside that channel and negotiates the IPsec SAs that carry user data: the transform set, the traffic to protect (proxy IDs), lifetimes and optional PFS. It produces a pair of one-way IPsec SAs.
Go deeper
Phase 1 parameters
Hash, Authentication method, DH Group, Lifetime, Encryption. Some people remember it as HAGLE.

Phase 2 parameters

Protocol and algorithms: ESP cipher and integrity (the transform set)

Mode: tunnel or transport

Proxy IDs (traffic selectors): local and remote networks

PFS group, if any

Lifetime in seconds and kilobytes

Cisco IOS defaults
The ISAKMP SA lifetime defaults to 86400 seconds. IPsec SA lifetimes default to 3600 seconds and 4,608,000 kilobytes.

Where to look
show crypto isakmp sa for IKEv1 phase 1, show crypto ikev2 sa for IKEv2, and show crypto ipsec sa for the IPsec SAs.
They will ask next
Why split it into two phases?
The expensive work, Diffie-Hellman and authentication, happens once in phase 1. Phase 2 SAs can then be created and rekeyed quickly under its protection, several of them for different traffic, without authenticating again.

Phase 1 is up and phase 2 is not. What do you compare?
What only phase 2 negotiates: transform sets, proxy IDs (the crypto ACLs must mirror), the PFS group, and mode. A debug on the responder usually names the item it rejected.
Traps
Saying user data flows over the phase 1 SA. The IKE SA only carries IKE messages.
How did you do?Book 8.5 Example Systems Book 8.3 Key Predistribution Own page
What is a security association, and what is the SPI for?
Say this first
An SA is the set of agreed parameters for one direction of protected traffic: protocol, cipher, keys, lifetime, sequence counter and the traffic it applies to. IPsec SAs are one-way, so a working tunnel has at least two, one inbound and one outbound, for each proxy ID pair. The SPI is a 32-bit number in every ESP or AH header that tells the receiver which of its inbound SAs, and so which keys, to use. The receiver chooses the SPI for its own inbound SA.
Go deeper
Two kinds of SA

The IKE SA is bidirectional and only carries IKE control messages.

IPsec SAs (Child SAs in IKEv2) are unidirectional and carry data.

Lookups
The receiver finds the SA by SPI, together with the destination address and protocol. Policy lives in the SPD (what to protect, bypass or discard); live SAs and keys live in the SAD.

The SPIs mirror between peers
Output
R1# show crypto ipsec sa | include spi current outbound spi: 0x5E3A91C4(1580896708) spi: 0x9B07D2E1(2600981217) spi: 0x5E3A91C4(1580896708)
The first spi: line is under "inbound esp sas", the second under "outbound esp sas". On the peer R2, 0x5E3A91C4 is its inbound SPI and 0x9B07D2E1 its outbound SPI.

Rekey
New SAs with new SPIs are built before the old ones expire, so for a short time both pairs exist.
They will ask next
How many SAs do you get from a crypto map whose ACL has two lines?
Two IPsec SA pairs, four SAs in total (two inbound, two outbound), plus one IKE SA to the peer.

What does an "invalid SPI" message mean?
The peer sent ESP with an SPI this router does not have, usually because one side rebooted or cleared its SAs while the other still uses the old ones. IOS logs %CRYPTO-4-RECVD_PKT_INV_SPI. DPD, or crypto isakmp invalid-spi-recovery for IKEv1, lets the two sides clean up and renegotiate.
Traps
Saying a tunnel has one SA. IPsec SAs come in pairs, one per direction, per selector pair.
How did you do?Book 8.5 Example Systems Own page

Traffic	Protocol and port	When
IKEv1 and IKEv2	UDP 500	always, to start
IKE and ESP with NAT-T	UDP 4500	NAT detected on the path, or NAT-T forced
ESP	IP protocol 50	no NAT on the path
AH	IP protocol 51	rare

What is Diffie-Hellman used for in IPsec, and which groups should you use?

Say this first

Diffie-Hellman lets the two peers compute the same secret over an untrusted network without ever sending it, and the IKE keys are derived from that secret. The group sets the math and the strength. Groups 1, 2 and 5 (768, 1024 and 1536-bit MODP) are too weak. Group 14 (2048-bit MODP) is the minimum; the elliptic-curve groups 19 (256-bit) and 20 (384-bit) give better strength for less CPU. Both peers must agree on the group.

Go deeper

Group	Type	Use
1, 2, 5	768, 1024, 1536-bit MODP	do not use
14	2048-bit MODP	acceptable minimum
15, 16	3072, 4096-bit MODP	strong but slow
19	256-bit ECP (NIST P-256)	recommended
20	384-bit ECP (NIST P-384)	recommended, typical for high-assurance policies
21	521-bit ECP	strong
24	2048-bit MODP with 256-bit subgroup	deprecated

Points to make

DH alone gives no authentication. The PSK or certificate check in IKE stops a man in the middle.
DH runs in phase 1 and again in phase 2 if PFS is enabled.
The Logjam research (2015) showed that weak and widely shared DH groups are realistic targets, which is why 1024-bit groups were dropped.

They will ask next

Why are the elliptic-curve groups faster?
They reach the same strength with much smaller numbers. A 256-bit curve is roughly as strong as 3072-bit MODP, so the math per exchange is far cheaper.
What happens when the DH groups do not match?
In IKEv1 phase 1 no proposal matches and negotiation stops after the first message pair; IOS shows the SA stuck in MM_NO_STATE. In IKEv2 the responder answers IKE_SA_INIT with INVALID_KE_PAYLOAD naming the group it wants, and the initiator retries with that group if it is in its own proposal.

Traps

Saying Diffie-Hellman encrypts the traffic. It only produces shared key material.

How did you do?Book 8.3 Key Predistribution Book 8.2 Cryptographic Building Blocks Own page

Which encryption and integrity algorithms would you choose for a new IPsec tunnel?
Say this first
For ESP, AES-GCM with 256-bit (or 128-bit) keys, which encrypts and authenticates in one pass, or AES-CBC with HMAC-SHA-256 or stronger where GCM is not available. For the IKE SA, AES-256 with SHA-256 or SHA-384 and DH group 19 or 20, with 14 as the minimum. Avoid DES, 3DES, MD5 and SHA-1, and DH groups 1, 2 and 5. Authenticate with certificates at scale, or long random pre-shared keys.
Go deeper
IOS-XE example
Cisco IOS
crypto ikev2 proposal PROP-STRONG encryption aes-gcm-256 prf sha384 group 20 crypto ipsec transform-set TS-GCM esp-gcm 256 mode tunnel
With AES-GCM in an IKEv2 proposal there is no separate integrity algorithm, so you set the PRF explicitly.

Why these

GCM is an AEAD cipher: less overhead and fast on hardware that accelerates it.

3DES and other 64-bit block ciphers are open to birthday attacks on long sessions (Sweet32, 2016).

Check the platform's crypto hardware: an algorithm it does not accelerate can drop throughput a lot.
They will ask next
Is HMAC-SHA1 broken?
The SHA-1 collision attacks do not directly break HMAC-SHA1, which relies on different properties. It is still deprecated by most security policies and compliance standards, so there is no reason to choose it for a new tunnel.

Do both ends need the same transform set?
They need at least one proposal in common. You can offer several in order of preference, and the responder picks one it also allows.
Traps
Calling 3DES strong because it is "triple". Its 64-bit block is the problem, and it is deprecated.
How did you do?Book 8.2 Cryptographic Building Blocks Own page
What is DMVPN, and what problem does it solve?
Say this first
DMVPN (Dynamic Multipoint VPN) is a Cisco design where one hub configuration serves hundreds of spokes and spokes can build direct tunnels to each other on demand. It combines multipoint GRE (one tunnel interface, many peers), NHRP (spokes register their public address with the hub and look each other up), an IPsec profile that encrypts the GRE, and a routing protocol across the tunnel. Spokes can have dynamic public addresses, and adding a spoke does not change the hub.
Go deeper
The pieces

mGRE: tunnel mode gre multipoint, no tunnel destination. NHRP supplies the destinations.

NHRP: the overlay's address resolution. It maps a tunnel address to the public (NBMA) address to send the GRE packet to.

IPsec: tunnel protection ipsec profile, with wildcard keys or certificates so any spoke can connect.

Routing: EIGRP, OSPF or BGP over the tunnel.

Why not static tunnels
A full mesh of N sites needs N(N-1)/2 tunnels: 1225 for 50 sites, each configured on both ends. With DMVPN every spoke configures only the hub, the hub configures no spokes, and spoke-to-spoke tunnels appear when traffic needs them and time out when it stops.
They will ask next
Is DMVPN a standard?
Its parts are: GRE (RFC 2784), NHRP (RFC 2332) and IPsec. DMVPN as a solution is Cisco. Other vendors offer similar designs, such as Juniper and Fortinet ADVPN.

How is DMVPN different from SD-WAN?
DMVPN is a configured overlay that relies on routing protocols, with no central controller. SD-WAN adds a controller for policy and keys, application-aware path choice across several transports, and central management. Cisco's Catalyst SD-WAN overlay is not built on DMVPN.
Traps
Saying DMVPN needs a static tunnel per spoke on the hub. The hub has one mGRE interface for all of them.
How did you do?Book 3.3 Internet (IP)Own page

SSL VPN or IPsec client for remote access? How do they differ?

Say this first

An SSL (TLS) VPN runs over TCP 443, usually with DTLS on UDP 443 for performance, so it passes through almost any hotel or guest network. It can be clientless through a browser portal or use a full tunnel client. An IPsec client uses IKE on UDP 500 and ESP or UDP 4500, which some networks block, but it is standards based, and IKEv2 clients are built into Windows, macOS, iOS and Android. Both can give full network access with per-user AAA and posture checks.

Go deeper

	SSL/TLS VPN	IPsec client (IKEv2)
Transport	TCP 443, plus DTLS on UDP 443	UDP 500 and 4500, or ESP
Passes restrictive networks	almost always	sometimes blocked
Clientless browser mode	yes, for web apps	no
Client	vendor client (Cisco Secure Client, GlobalProtect, FortiClient)	built into the OS, or vendor
User authentication	AAA, SAML, MFA, certificates	EAP, certificates

TCP over TCP

If the tunnel itself runs over TCP and carries TCP, both layers retransmit on loss and throughput collapses on lossy links. That is why SSL VPN clients prefer DTLS over UDP and fall back to TLS only when UDP is blocked.

Vendor notes

Cisco Secure Client uses TLS plus DTLS by default and can use IKEv2. GlobalProtect tries an IPsec tunnel on UDP 4501 first and falls back to SSL.

They will ask next

What is posture assessment?
The headend checks the device before or after it connects: OS patch level, disk encryption, endpoint protection running, company-managed or not. The result decides full, limited or no access.
Where does zero trust network access fit?
ZTNA gives access to specific applications after checking user and device, instead of placing the device on the network. Many companies are moving from network-level remote-access VPN to it for most apps.

Traps

Saying SSL VPN is always clientless. Most deployments use a full tunnel client.

How did you do?Book 8.5 Example Systems Own page

What is split tunneling, and what are the risks?
Say this first
With split tunneling, only traffic for company networks goes through the VPN and everything else goes straight to the internet. Full tunnel sends everything through the VPN. Split tunnel saves headend bandwidth and gives users faster SaaS and video, but internet traffic skips the company's web filtering and logging, and the laptop is on the internet and the company network at the same time. A common middle ground is full tunnel with exclusions for trusted, high-volume SaaS.
Go deeper
Variants

Split include: only the listed company prefixes use the tunnel.

Split exclude: everything uses the tunnel except listed prefixes, such as collaboration media.

Dynamic split by domain in some clients, for SaaS whose addresses change often.

Local LAN access: allows the home printer while the tunnel is up.

DNS is part of the design
Split DNS sends queries for company domains through the tunnel to internal resolvers and the rest to the local resolver. Without it, internal names fail or leak to public resolvers.

Historical note
When most staff moved to home working in 2020, many full-tunnel headends saturated and companies moved collaboration traffic to split exclude.
They will ask next
How do you keep web security with split tunnel?
Inspect on the endpoint or in a cloud security service the client always uses, so internet traffic is filtered wherever the user is, with or without the VPN.

What is split DNS in one sentence?
The client resolves company domains such as corp.example.com with internal DNS through the tunnel and everything else with its local resolver.
Traps
Treating split tunnel as only a bandwidth setting. It is a security decision about where internet traffic is inspected.
How did you do?Book 8.5 Example Systems Own page
What is WireGuard, and how is it different from IPsec?
Say this first
WireGuard is a small, modern VPN protocol that runs over UDP only. It uses one fixed set of algorithms (Curve25519 for key exchange, ChaCha20-Poly1305 for encryption, BLAKE2s for hashing) instead of negotiating ciphers, and each peer is identified by a public key. A one round trip handshake creates session keys that rotate every two minutes. Configuration is a few lines per peer. It has no built-in user authentication, address assignment or policy engine, which IPsec and SSL VPN products provide around their protocols.
Go deeper
Facts to have ready

UDP on any port; 51820 is only the convention used in the documentation and examples.

Overhead: 60 bytes over IPv4 (20 IP, 8 UDP, 32 WireGuard), 80 over IPv6. wg-quick sets the interface MTU to the outgoing link MTU minus 80, so 1420 on a 1500-byte link.

Silent: it does not answer packets that are not authenticated by a known key, so a port scan sees nothing.

Roaming: a peer's endpoint is updated to the source address of its latest authenticated packet.

PersistentKeepalive (often 25 seconds) keeps NAT mappings open for peers behind NAT.

In the Linux kernel since 5.6 (2020), with implementations for Windows, macOS, BSD and many routers.

No cipher negotiation: if an algorithm is broken, the protocol version changes instead.

A minimal peer
Output
[Interface] Address = 172.16.99.1/30 ListenPort = 51820 PrivateKey = (this host's private key) [Peer] PublicKey = (the peer's public key) Endpoint = 203.0.113.20:51820 AllowedIPs = 172.16.99.2/32, 10.2.0.0/24
They will ask next
Can WireGuard be used where FIPS-validated crypto is required?
Usually not: ChaCha20-Poly1305 and BLAKE2s are not FIPS-approved algorithms, so regulated environments tend to stay with IPsec using AES and NIST curves.

How does WireGuard deal with NAT?
It is plain UDP, so NAT works like any UDP flow. The peer behind NAT sends keepalives so the mapping stays open, and the other side learns its current public address and port from the packets it receives.
Traps
Saying WireGuard negotiates ciphers or runs over TCP. It does neither.
How did you do?Book 8.5 Example Systems Own page

Working16

What is the difference between IKEv1 main mode and aggressive mode?

Say this first

Main mode uses six messages: two to agree the policy, two for the Diffie-Hellman values and nonces, and two, already encrypted, to exchange identities and authenticate. Aggressive mode squeezes that into three messages, so the identities go out before encryption is in place. With a pre-shared key, the aggressive-mode hash can be captured and attacked offline, so main mode is preferred. Aggressive mode exists for peers with dynamic addresses where the responder needs the identity to pick the right key.

Go deeper

Main mode

Msg	Direction	Content
1	initiator to responder	SA proposals
2	responder to initiator	chosen proposal
3	initiator to responder	DH public value, nonce (plus NAT-D hashes with NAT-T)
4	responder to initiator	DH public value, nonce (plus NAT-D)
5	initiator to responder	encrypted: identity, authentication
6	responder to initiator	encrypted: identity, authentication

Aggressive mode

Msg	Direction	Content
1	initiator to responder	SA proposals, DH value, nonce, identity
2	responder to initiator	chosen SA, DH value, nonce, identity, authentication hash
3	initiator to responder	authentication hash

The PSK catch in main mode

With a PSK, the keys that protect messages 5 and 6 are derived from the PSK, so the responder must choose the key before it has seen the peer's identity. It can only choose by source IP address. That is why main mode with PSK and dynamic peer addresses needs a wildcard key (crypto isakmp key KEY address 0.0.0.0), and why certificates or IKEv2 are the better answer.

They will ask next

Does IKEv2 have an aggressive mode?
No. IKEv2 has one initial exchange of four messages, IKE_SA_INIT and IKE_AUTH, and identities are always sent encrypted in IKE_AUTH.
How can you tell the modes apart in IOS show output?
The ISAKMP SA states differ. Main mode states start with MM_ (MM_NO_STATE, MM_SA_SETUP, MM_KEY_EXCH), aggressive mode states with AG_. Both end in QM_IDLE once phase 1 is complete.

Traps

Saying aggressive mode uses weaker ciphers. Same ciphers; the weakness is identity exposure and offline cracking of the PSK.

How did you do?Book 8.4 Authentication Protocols Own page

Describe the IKEv2 exchanges. How many messages does it take to bring up a tunnel?

Say this first

Four messages. IKE_SA_INIT (two messages) negotiates the IKE SA algorithms, exchanges Diffie-Hellman values and nonces, and detects NAT. IKE_AUTH (two messages, encrypted) exchanges identities and authentication and also creates the first Child SA, the IPsec SA, with its traffic selectors. After that, CREATE_CHILD_SA exchanges add Child SAs or rekey, and INFORMATIONAL exchanges carry deletes, errors and liveness checks.

Go deeper

Exchange	Messages	Carries
IKE_SA_INIT	1 and 2	SA proposals, KE, nonces, NAT detection notifies, optional certificate request
IKE_AUTH	3 and 4	encrypted: identities, AUTH, certificates, Child SA proposal, TSi and TSr
CREATE_CHILD_SA	2 per exchange	new Child SA, rekey of a Child SA or the IKE SA, optional KE for PFS
INFORMATIONAL	2 per exchange	Delete, Notify, or an empty message used as a liveness check

Reliability

Every exchange is a request and a response with a message ID. Only the initiator of an exchange retransmits, so lost packets are handled cleanly.

Anti-DoS cookie

A responder under load can answer IKE_SA_INIT with a COOKIE notify and keep no state. The initiator repeats its first message with the cookie, proving its source address is real. That makes the setup six messages.

Longer cases

EAP authentication for remote-access users adds round trips inside IKE_AUTH. The standard is RFC 7296.

They will ask next

Does PFS apply to the first Child SA?
No. The first Child SA's keys come from the IKE_SA_INIT Diffie-Hellman exchange; IKE_AUTH carries no KE payload. The PFS group is used when that Child SA is rekeyed with CREATE_CHILD_SA. So a PFS mismatch often stays hidden until the first rekey, which is an hour later with IOS defaults.
How do you recognise IKEv2 in a capture?
UDP 500 or 4500, IKE header version 2.0, and exchange type 34 for IKE_SA_INIT, 35 for IKE_AUTH, 36 for CREATE_CHILD_SA and 37 for INFORMATIONAL.

Traps

Saying IKEv2 still has main mode and aggressive mode.

How did you do?Book 8.5 Example Systems Book 8.4 Authentication Protocols Own page

Why is IKEv2 better than IKEv1? Give concrete differences.

Say this first

IKEv2 does the job in four messages instead of six plus three. NAT traversal and dead peer detection are built in instead of bolted on. It has cookies against DoS floods, EAP for remote-access user authentication, asymmetric authentication (each side may use a different method), reliable request-response exchanges, and traffic selector narrowing. Lifetimes are not negotiated, each peer rekeys on its own timer, which removes a class of mismatches.

Go deeper

Topic	IKEv1	IKEv2
Messages to the first IPsec SA	9 (main + quick) or 6 (aggressive + quick)	4
NAT traversal	extension, RFC 3947	built in
Dead peer detection	extension, RFC 3706	built in liveness check
Remote-access user auth	XAUTH, vendor extension	EAP, standard
Authentication method	same on both sides	can differ per side
DoS protection	none	cookies
Lifetimes	proposed in negotiation	local only
Selector mismatch	fails	responder can narrow
Mobility	none	MOBIKE (RFC 4555)

Both use UDP 500 and 4500. They are different protocols: a v1 peer and a v2 peer cannot form a tunnel with each other, so both ends must be configured for the same version.

They will ask next

What is traffic selector narrowing?
The initiator proposes a range and the responder may answer with a smaller subset it accepts, instead of failing. IKEv1 has no clean way to do this, which is why mismatched proxy IDs fail hard there.
Does IKEv2 ever run over TCP?
The standard transport is UDP. RFC 8229 defines carrying IKE and ESP over TCP for networks that block UDP, and some vendors support it as an option, but it is the exception.

Traps

Saying IKEv2 is "IKEv1 with stronger ciphers". The ciphers are the same; the protocol design is what changed.

How did you do?Book 8.5 Example Systems Own page

How does NAT traversal work in IPsec, and why is it needed?
Say this first
ESP has no ports, so a PAT device cannot tell flows apart, and any NAT breaks AH. NAT-T first detects NAT during IKE: each side sends hashes of the addresses and ports it believes it is using, and if what the peer receives does not match, there is a NAT in the path. The peers then move IKE to UDP 4500 and put every ESP packet inside a UDP 4500 header, which NAT devices handle like any UDP flow. Small keepalives hold the NAT mapping open.
Go deeper
IKEv1 (RFC 3947 and RFC 3948)

Messages 1 and 2: vendor ID payloads show both sides support NAT-T.

Messages 3 and 4: NAT-D payloads carry a hash of each side's address and port.

If a received hash does not match what the receiver computes, NAT is present. From message 5 on, IKE uses UDP 4500.

Data travels as IP, UDP 4500, ESP. IKE messages on UDP 4500 start with four zero bytes (the non-ESP marker); ESP never has an SPI of zero, so the receiver can tell them apart.

IKEv2
The same idea is built in: NAT_DETECTION_SOURCE_IP and NAT_DETECTION_DESTINATION_IP notifies in IKE_SA_INIT, then the switch to UDP 4500 from IKE_AUTH on.

Keepalives
A one-byte UDP packet (0xFF) refreshes the NAT mapping. On IOS: crypto isakmp nat keepalive 20.

Cost
8 more bytes per packet for the UDP header. Leave room for it in the tunnel MTU.
They will ask next
What do you forward on a firewall that sits in front of a VPN gateway doing NAT?
UDP 500 and UDP 4500 to the gateway. ESP protocol 50 is not used once NAT-T is active.

A tunnel through NAT works, then dies after a few idle minutes. Why?
The NAT device timed out the UDP 4500 mapping, so packets from the far side no longer reach the gateway. Make the NAT-T keepalive interval shorter than the NAT idle timeout, or keep traffic flowing with DPD or routing hellos.
Traps
Saying NAT-T only moves IKE to UDP 4500. ESP moves into UDP 4500 too.
How did you do?Book 8.5 Example Systems Own page
What is Perfect Forward Secrecy in IPsec, and what does it cost?
Say this first
With PFS, each set of phase 2 keys comes from a fresh Diffie-Hellman exchange instead of from the phase 1 key material. If an attacker later obtains one set of keys, they cannot derive the keys of other SAs, so traffic recorded in other periods stays safe. The cost is one extra DH computation per phase 2 negotiation and rekey, and both peers must agree on the PFS group or phase 2 fails.
Go deeper
Configuration on IOS
Cisco IOS
crypto ipsec profile VTI-PROF set transform-set TS-AES256 set pfs group19 set ikev2-profile IKEV2-PROF
For a crypto map, set pfs group19 goes under the crypto map entry.

How it works

IKEv1: quick mode messages 1 and 2 carry KE payloads, and the new DH secret feeds the IPsec keys.

IKEv2: the first Child SA, built in IKE_AUTH, has no DH of its own. PFS applies when Child SAs are created or rekeyed with CREATE_CHILD_SA.

Choosing the group
Use the same group as phase 1 or a stronger one. A strong phase 1 group with a weak PFS group gives the IPsec keys only the weak protection.
They will ask next
Without PFS, what is exposed if the IKE SA keys leak?
In IKEv1 the IPsec keys are derived from SKEYID_d of the ISAKMP SA plus nonces exchanged inside it. With the IKE keys and a capture of the quick modes, an attacker can compute every IPsec key made under that IKE SA. PFS breaks that chain because each Child SA adds a DH secret that was never sent.

Does PFS protect against a stolen pre-shared key?
A passive eavesdropper who only has the PSK still cannot decrypt recorded traffic, because the keys also depend on DH secrets that never crossed the wire. An active attacker with the PSK can impersonate a peer in new sessions, and no DH option prevents that. Rotate the key.
Traps
Calling PFS a phase 1 setting. It is negotiated for the IPsec (Child) SAs.
How did you do?Book 8.3 Key Predistribution Own page
How do IPsec lifetimes and rekeying work, and what are the Cisco defaults?
Say this first
Every SA expires after a time or a traffic volume, whichever comes first, and is replaced before it expires so traffic does not stop. On IOS the IKE SA lifetime defaults to 86400 seconds, and IPsec SAs to 3600 seconds or 4,608,000 kilobytes. In IKEv1 lifetimes are proposed during negotiation; in IKEv2 they are not negotiated and each peer rekeys on its own timer.
Go deeper
Seeing the clock
Output
sa timing: remaining key lifetime (k/sec): (4607862/3412)
This line in show crypto ipsec sa shows the kilobytes and seconds left on that SA.

Changing it on IOS
Cisco IOS
crypto isakmp policy 10 lifetime 28800 crypto ipsec security-association lifetime seconds 3600 crypto ipsec security-association lifetime kilobytes 4608000 crypto ikev2 profile IKEV2-PROF lifetime 86400
Matching rules

IKEv1 phase 1 on IOS: a policy matches when the peer's proposed lifetime is equal to or shorter than the local one, and the shorter value is used.

IKEv2: no negotiation. The side with the shorter lifetime starts the rekey.

Why a volume limit
It caps how much data one key protects and forces a rekey before the 32-bit ESP sequence number can wrap. Very fast links use extended sequence numbers (64-bit) for that reason.
They will ask next
Do the IPsec SAs die when the IKE SA expires?
In IKEv1 no: IPsec SAs have their own lifetimes and keep working; a new ISAKMP SA is built when needed for the next quick mode. In IKEv2 the Child SAs belong to the IKE SA: deleting the IKE SA deletes them, so the IKE SA is rekeyed in place with CREATE_CHILD_SA instead.

A long file transfer stalls for a few seconds every hour. Where do you look?
At the rekey. Debug around the stall, check for a PFS or proposal mismatch that only matters at rekey, and check whether the old SA is removed before the new one is installed on both sides.
Traps
Insisting lifetimes must match or the tunnel fails. Mismatches are tolerated in most cases; they change who rekeys and when.
How did you do?Book 8.5 Example Systems Own page

Compare crypto maps with virtual tunnel interfaces. Which would you deploy today?

Say this first

A crypto map is policy-based: it is applied to the physical outside interface and an ACL decides which traffic is encrypted to which peer. A VTI is route-based: a tunnel interface with tunnel protection, and anything routed into it is encrypted. I would deploy VTIs. They run routing protocols, take per-tunnel QoS, ACLs and NAT, use one simple any-to-any selector, and show up in the routing table and interface counters like any link. Crypto maps stay for interop with peers that only do policy-based VPNs.

Go deeper

	Crypto map	Static VTI
Model	policy-based	route-based
What gets encrypted	traffic matching the crypto ACL	traffic routed into the tunnel
Routing protocols	no (needs GRE)	yes
Selectors	one SA pair per ACL line	one pair, 0.0.0.0/0 both sides
Monitoring	SA counters	interface counters, SNMP, line protocol
Failover	several `set peer` entries plus DPD	routing over two tunnels

Crypto map

Cisco IOS

crypto map VPNMAP 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set TS-AES256
 match address VPN-TRAFFIC
interface GigabitEthernet0/0/0
 crypto map VPNMAP

VTI

Cisco IOS

interface Tunnel0
 ip address 172.16.12.1 255.255.255.252
 tunnel source GigabitEthernet0/0/0
 tunnel mode ipsec ipv4
 tunnel destination 203.0.113.2
 tunnel protection ipsec profile VTI-PROF
ip route 10.2.0.0 255.255.255.0 Tunnel0

They will ask next

What is a dynamic VTI?
A hub-side template: interface Virtual-Template1 type tunnel with tunnel protection. Each peer that connects gets its own cloned Virtual-Access interface. It suits many spokes or remote access, and it is the base of FlexVPN.
Your VTI must connect to a peer that only supports policy-based VPNs. What do you do?
The peer will propose specific subnets and my VTI expects any to any, so phase 2 fails. Either use a crypto map for that one peer, or get the peer to switch to a route-based tunnel with 0.0.0.0/0 selectors. Most current firewalls and cloud gateways support route-based mode.

Traps

Building the VTI and forgetting the route. Nothing is encrypted until the remote prefixes point into the tunnel.

How did you do?Book 8.5 Example Systems Own page

What are proxy IDs or traffic selectors, and why must the crypto ACLs mirror each other?
Say this first
Proxy IDs (IKEv1) or traffic selectors (IKEv2) are the local and remote networks, and optionally the protocol and ports, that a phase 2 SA protects. Each side proposes them from its own policy and the other side must accept them. If my ACL says 10.1.0.0/24 to 10.2.0.0/24, the peer's must say 10.2.0.0/24 to 10.1.0.0/24, a mirror image. A mismatch leaves phase 1 up and phase 2 failing.
Go deeper
Mirrored crypto ACLs
Cisco IOS
! R1 (HQ) ip access-list extended VPN-TRAFFIC permit ip 10.1.0.0 0.0.0.255 10.2.0.0 0.0.0.255 ! R2 (branch) ip access-list extended VPN-TRAFFIC permit ip 10.2.0.0 0.0.0.255 10.1.0.0 0.0.0.255
Rules

Each permit line becomes its own SA pair.

Avoid permit ip any any in a crypto map ACL: it tries to encrypt everything leaving the interface, including internet traffic.

A route-based peer proposes 0.0.0.0/0 to 0.0.0.0/0. A policy-based peer must be configured to match.

Names by vendor
Platform Term
Cisco IOS crypto ACL, proxy identities
Palo Alto Proxy ID on the IPsec tunnel
FortiOS phase 2 selectors
Junos proxy-identity or traffic-selector
They will ask next
What does a deny line in a crypto ACL do?
It means "do not protect this traffic with this crypto map entry". The packet is not dropped: it is checked against later entries and otherwise sent in clear. To block traffic, use an interface ACL.

Palo Alto to a Cisco crypto map, phase 1 up, phase 2 fails. Most likely fix?
The Palo Alto tunnel is route-based and, without proxy IDs, proposes 0.0.0.0/0 both ways, which the Cisco crypto ACL rejects. Add proxy IDs on the Palo Alto tunnel that mirror each line of the Cisco ACL.
Traps
Saying the ACLs must be identical. They must be mirror images, source and destination swapped.
How did you do?Book 8.5 Example Systems Own page
What is NAT exemption for a VPN, and what happens if you forget it?
Say this first
On IOS and most firewalls, outbound NAT happens before the packet is checked against the VPN policy. If LAN-to-LAN traffic is translated to the public address first, it no longer matches the crypto ACL or proxy ID and leaves unencrypted, where it is lost. NAT exemption is a rule that says traffic from my LAN to the remote LAN is not translated. Forget it on one side and you get a tunnel that is up with traffic flowing in one direction only.
Go deeper
IOS
Cisco IOS
ip access-list extended NAT-ACL 10 deny ip 10.1.0.0 0.0.0.255 10.2.0.0 0.0.0.255 20 permit ip 10.1.0.0 0.0.0.255 any ip nat inside source list NAT-ACL interface GigabitEthernet0/0/0 overload
The deny line must come before the permit. A standard ACL cannot do this because it cannot match on destination.

Why a VTI mostly avoids it
With a VTI, VPN traffic exits through Tunnel0. Tunnel0 is not an ip nat outside interface, so the PAT rule on Gi0/0/0 never applies to it.

The symptom
Router encaps decaps
Side with exemption rising 0
Side without exemption 0 rising
show ip nat translations on the broken side shows entries whose outside address is in the remote LAN.

Firewalls
On a Cisco ASA it is identity NAT, for example nat (inside,outside) source static LAN LAN destination static REMOTE REMOTE no-proxy-arp route-lookup. On zone-based firewalls with route-based tunnels, putting the tunnel interface in its own zone keeps the internet source NAT rule from matching.
They will ask next
You added the deny line, but some users still fail. Why?
Existing translations stay in the table and keep being used until they time out. Clear them with clear ip nat translation *, which briefly disturbs every NATed flow, or wait for them to age out.

Why is it one way instead of fully broken?
The side with the exemption encrypts correctly and the peer decrypts and delivers. The replies hit PAT on the side without the exemption, leave in clear toward a private address and are dropped. So one router sees encaps and no decaps, and the other the reverse.
Traps
Putting the deny line after the permit line. ACLs are read top down, so it never matches.
How did you do?Book 8.5 Example Systems Own page
What is dead peer detection, and how do you configure it?
Say this first
DPD lets a gateway find out that its peer has gone away, so it can delete the stale SAs and fail over or rebuild, instead of encrypting traffic into SAs nobody is listening to. In IKEv1 it is an extension (R-U-THERE and R-U-THERE-ACK messages, RFC 3706); in IKEv2 it is built in as an empty INFORMATIONAL exchange. Periodic mode probes on a timer; on-demand mode probes only when there is traffic to send and nothing has been received.
Go deeper
IOS
Cisco IOS
! IKEv1, global: probe every 10 s, retry every 3 s, always crypto isakmp keepalive 10 3 periodic ! IKEv2, per profile: only when needed crypto ikev2 profile IKEV2-PROF dpd 10 3 on-demand
Choosing the mode

On-demand costs nothing on an idle tunnel but only notices failure when traffic needs to go.

Periodic detects failure on idle tunnels too, which matters for failover designs.

Where it fits

With crypto maps listing two peers (set peer twice), DPD is what triggers failover to the second peer.

With VTIs, the routing protocol or BFD over the tunnel usually moves traffic faster; DPD cleans up the SAs.
They will ask next
How is DPD different from NAT-T keepalives?
NAT-T keepalives are one-byte UDP 4500 packets that only refresh NAT state; nobody answers them. DPD is a protected IKE request that expects a reply and decides whether the peer is alive.

What happens without DPD when the peer reboots?
The surviving side keeps its old SAs and encrypts into them until they expire, up to an hour with IOS defaults. The rebooted peer drops those packets as invalid SPI. With DPD the survivor notices within seconds, deletes the SAs and renegotiates.
Traps
Confusing DPD with GRE keepalives. GRE keepalives test the GRE tunnel; DPD tests the IKE peer.
How did you do?Book 8.5 Example Systems Own page
Pre-shared keys or certificates for IPsec authentication? What are the trade-offs?
Say this first
PSKs are simple and fine for a handful of tunnels, but every key is distributed and rotated by hand, a leaked key exposes every tunnel that shares it, and wildcard keys for dynamic peers are a big weakness. Certificates scale: each device has its own key pair signed by a CA, peers are checked against the CA and revocation, and adding a device touches nothing else. The price is running a PKI: enrollment, renewal, CRL or OCSP availability, and correct clocks everywhere.
Go deeper
PSK hygiene

Long and random, unique per peer where possible.

A weak PSK can be attacked offline from captured exchanges, and IKEv1 aggressive mode makes that easy.

Certificates on IOS, the moving parts

crypto pki trustpoint with enrollment (SCEP or manual), subject name and revocation policy.

In the IKEv2 profile: authentication local rsa-sig, authentication remote rsa-sig and pki trustpoint NAME.

revocation-check crl none means check the CRL, but accept the certificate if the CRL cannot be fetched. Decide that on purpose.

Operational traps

Clock: certificates have validity dates. Without NTP, a router whose clock is wrong rejects valid certificates.

CRL reachability: if the CRL lives behind the tunnel it protects, a strict check can block the tunnel that would fetch it.
They will ask next
Why do certificate tunnels often fail at a branch after a power cut?
The router boots with the wrong time, so peer certificates look not yet valid or expired, and IKE authentication fails until NTP corrects the clock. Make sure NTP is reachable without the tunnel.

Can the two sides use different authentication methods?
In IKEv2, yes: authentication is per direction, for example the hub signs with a certificate and a user authenticates with EAP. IKEv1 needs the same method on both sides.
Traps
One PSK shared by every branch. One leak or one departing admin exposes the whole network.
How did you do?Book 8.4 Authentication Protocols Book 8.3 Key Predistribution Own page

Platform	Term
Cisco IOS	crypto ACL, proxy identities
Palo Alto	Proxy ID on the IPsec tunnel
FortiOS	phase 2 selectors
Junos	proxy-identity or traffic-selector

Router	encaps	decaps
Side with exemption	rising	0
Side without exemption	0	rising

The VPN shows up, but no traffic passes. How do you troubleshoot it?

Say this first

"Up" usually means the IKE SA is up. I check that IPsec SAs exist and read the encaps and decaps counters on both ends while sending test traffic. Encaps at zero means the traffic never reaches the encryption: routing, the crypto ACL or NAT exemption on the sending side. Encaps rising but the peer's decaps at zero means the packets die in transit: an ACL or ISP filter on ESP or UDP 4500. Decaps rising but no replies means the remote side: its NAT exemption, its route back, or a host firewall.

Go deeper

Commands, in order

Cisco IOS

show crypto session detail
show crypto ipsec sa peer 203.0.113.2
show ip route 10.2.0.0
show ip nat translations
show access-lists

Reading the counters for traffic from site 1 to site 2

R1 encaps	R2 decaps	R2 encaps	R1 decaps	Where it breaks
0	0	any	any	R1 never sends into the tunnel: route, crypto ACL, NAT
rising	0	any	any	in transit: ESP or UDP 4500 blocked
rising	rising	0	0	R2 return path: NAT exemption, route back, crypto ACL
rising	rising	rising	rising	tunnel works; look at hosts, inside firewalls, MTU

Test traffic from the right source

A ping from the router itself is sourced from the outside interface and does not match the crypto ACL. Use ping 10.2.0.10 source GigabitEthernet0/0/1.

With a VTI

Check that the route to the remote LAN points into Tunnel0, and look at the tunnel interface counters as well as the SA counters.

They will ask next

Counters rise on both routers but the application still fails. What next?
The tunnel is doing its job. Look past it: the server's default gateway may not be the VPN router, an inside firewall may block the flow, the host firewall may drop it, or large transfers may hit an MTU problem while small pings pass.
When would you clear the SAs?
After I have collected the evidence, or when the SAs are clearly stale, for example after the peer rebooted. Clearing first destroys the counters that tell me where traffic stops.

Traps

Testing with a plain ping from the router and concluding the tunnel is broken.

How did you do?Book 8.5 Example Systems Own page

How does NHRP work in DMVPN?
Say this first
NHRP maps an overlay tunnel address to the underlay (NBMA) address that GRE packets must be sent to. Each spoke has the hub configured as its next hop server and sends it a registration: my tunnel address is 172.16.0.2 and my public address is 198.51.100.2. The hub builds its table from those registrations. When a spoke needs another spoke's public address, it sends a resolution request, and the answer lets it build a direct tunnel. Entries are refreshed and expire with a hold time.
Go deeper
Hub
Cisco IOS
interface Tunnel0 ip nhrp network-id 1 ip nhrp map multicast dynamic
map multicast dynamic copies multicast (routing hellos) to every spoke that has registered.

Spoke
Cisco IOS
interface Tunnel0 ip nhrp network-id 1 ip nhrp nhs 172.16.0.1 nbma 192.0.2.1 multicast
That one-line form replaces the older three lines: ip nhrp map 172.16.0.1 192.0.2.1, ip nhrp map multicast 192.0.2.1 and ip nhrp nhs 172.16.0.1.

Message types
Registration request and reply, resolution request and reply, purge, error, and in phase 3 the redirect (traffic indication).

Details interviewers like

The network ID is local to the router, but it must be set because it enables NHRP on the interface. Keeping it the same everywhere avoids confusion.

ip nhrp authentication is a clear-text string of up to 8 characters. It separates DMVPN clouds; it is not security.

ip nhrp holdtime defaults to 7200 seconds on IOS, and spokes re-register before it runs out.
They will ask next
What breaks if the hub lacks ip nhrp map multicast dynamic?
Routing hellos from the hub never reach the spokes, so EIGRP or OSPF adjacencies do not form, even though unicast pings across the tunnel work.

The spoke sits behind NAT. Which address does the hub record?
The post-NAT address it sees in the packets, and spoke-to-spoke tunnels use that. show dmvpn marks such entries with N (NATed). IPsec runs over UDP 4500 in that case.
Traps
Calling NHRP a routing protocol. It resolves addresses; a routing protocol still provides the prefixes.
How did you do?Book 3.3 Internet (IP)Own page

Explain DMVPN phase 1, phase 2 and phase 3.

Say this first

Phase 1 is hub-and-spoke only: spokes use point-to-point GRE to the hub and all spoke-to-spoke traffic goes through the hub. Phase 2 adds direct spoke-to-spoke tunnels: spokes use mGRE, the routing protocol keeps the remote spoke as next hop, and the spoke resolves that next hop with NHRP. The catch is that the hub cannot summarize. Phase 3 keeps spoke-to-spoke but lets the hub summarize: the hub sends an NHRP redirect when traffic hairpins through it, and the spoke installs a shortcut for the specific prefix.

Go deeper

	Phase 1	Phase 2	Phase 3
Spoke tunnel	point-to-point GRE	mGRE	mGRE
Spoke to spoke	through the hub	direct, triggered by the next hop in the routing table	direct, triggered by a hub redirect
Hub summarization	yes	no	yes, even just a default
Key commands		EIGRP: no next-hop-self, no split horizon; OSPF: broadcast, hub is DR	hub `ip nhrp redirect`, spokes `ip nhrp shortcut`
Hierarchical hubs	no	awkward	supported

Why phase 3 is the default choice today

Spokes carry only a summary or default plus the shortcuts they use, routing tables stay small, and the hub design can grow into regions without changing spokes.

They will ask next

Why can the hub not summarize in phase 2?
In phase 2 a spoke builds a direct tunnel only when its routing table shows the other spoke's tunnel address as next hop. A summary from the hub has the hub as next hop, so all traffic follows it through the hub.
Why do spokes need OSPF priority 0 in phase 2?
Phase 2 uses OSPF network type broadcast so the next hop is preserved. The DR must be able to reach every router with multicast, and only the hub can. A spoke elected DR breaks the adjacencies, so spokes get priority 0 and the hub a high priority.

Traps

Saying phase 3 means three tunnels or three hubs. The phases are design generations.

How did you do?Book 3.3 Internet (IP)Own page

What is cryptokey routing in WireGuard, and what does AllowedIPs do?
Say this first
Each peer is a public key plus a list of AllowedIPs. For outgoing packets, WireGuard picks the peer whose AllowedIPs best match the destination, like a routing table, and encrypts to that peer. For incoming packets, after decryption it checks that the inner source address is inside the AllowedIPs of the peer that sent it and drops the packet otherwise. So AllowedIPs is both the route and the source filter, and one prefix can belong to only one peer on an interface.
Go deeper
Site-to-site example
On Peer AllowedIPs
GW1 (LAN 10.1.0.0/24) GW2 172.16.99.2/32, 10.2.0.0/24
GW2 (LAN 10.2.0.0/24) GW1 172.16.99.1/32, 10.1.0.0/24
If GW2 forgets 10.1.0.0/24, packets from GW1's LAN arrive, decrypt, and are dropped because their source is not allowed for that peer.

Kernel routing still matters
The kernel decides which interface a packet uses. wg-quick adds routes for each AllowedIPs entry; with plain ip link add wg0 type wireguard you add them yourself.

Behaviours worth knowing

AllowedIPs = 0.0.0.0/0 makes that peer the default for everything, the usual full-tunnel client.

Adding a prefix to one peer removes it from any other peer on the same interface.

For dynamic routing, a common pattern is one peer per wg interface with 0.0.0.0/0, and BGP or OSPF programming the kernel routes.
They will ask next
A branch host cannot reach HQ over WireGuard although the latest handshake is recent. What do you check?
AllowedIPs on both sides for the LAN prefixes, the kernel routes to the remote LAN via wg0, net.ipv4.ip_forward=1 on both gateways, firewall forward rules, and whether HQ servers route the branch prefix back to the WireGuard gateway.

Does a recent handshake prove that traffic flows?
It proves the keys, endpoint and UDP path work. Data can still fail on AllowedIPs, routing, forwarding or firewall rules.
Traps
Calling AllowedIPs "just an ACL". It also decides which peer an outgoing packet is encrypted to.
How did you do?Book 8.5 Example Systems Own page
What do `ip mtu` and `ip tcp adjust-mss` on a tunnel interface actually do?
Say this first
ip mtu 1400 is the largest IP packet the router sends into the tunnel before encapsulation. A bigger packet with DF clear is fragmented before encryption, so the far gateway does not have to reassemble anything; one with DF set is dropped and the router sends an ICMP "fragmentation needed" message with MTU 1400 so the sender can shrink its packets. ip tcp adjust-mss 1360 rewrites the MSS option in TCP SYN and SYN-ACK packets crossing the interface, so TCP never sends segments larger than 1360 bytes of data: 1360 plus 20 bytes of IP and 20 of TCP is 1400. MSS clamping keeps TCP working even when ICMP is blocked.
Go deeper
The usual pair
Cisco IOS
interface Tunnel0 ip mtu 1400 ip tcp adjust-mss 1360
Fragment before or after encryption

Before: the inner packet is split, each fragment is encrypted on its own, and the destination host reassembles. Cheap for the VPN routers.

After: the ESP packet is split, and the receiving gateway must reassemble before it can decrypt. Expensive, and some platforms do it in software.

Path MTU discovery black holes
Hosts send with DF set and wait for ICMP type 3 code 4. If a firewall drops those messages, large packets vanish silently: small requests work, big transfers hang. MSS clamping hides this for TCP.

Other platforms

IPv6 inside the tunnel: ipv6 tcp adjust-mss 1340 (60 bytes of IPv6 and TCP headers).

Linux:
Shell
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
They will ask next
Why not raise the WAN MTU instead?
You do not control the internet path, and it is 1500 almost everywhere. Inside a private WAN or a data center you can raise the underlay MTU to 1600 or more, which is the clean fix and what VXLAN fabrics do.

Does adjust-mss help UDP?
No. It only edits TCP SYNs. Large UDP, such as DNS with big responses or video, still depends on ip mtu with fragmentation or on working PMTUD.
Traps
Setting ip mtu only and assuming TCP is fine. Without MSS clamping, TCP depends on ICMP getting back to the sender.
How did you do?Book 5.2 Reliable Byte Stream (TCP)Book 3.3 Internet (IP)Own page

On	Peer	AllowedIPs
GW1 (LAN 10.1.0.0/24)	GW2	172.16.99.2/32, 10.2.0.0/24
GW2 (LAN 10.2.0.0/24)	GW1	172.16.99.1/32, 10.1.0.0/24

Expert7

What happens in IKEv1 quick mode, message by message?

Say this first

Quick mode is phase 2: three messages, all protected by the ISAKMP SA. The initiator sends its proposals (transform sets with the SPI it wants for its inbound SA), a nonce, its proxy IDs and a DH value if PFS is on. The responder checks the proxy IDs against its own policy, picks a proposal and answers with its SPI, nonce and DH value. The third message is a hash that confirms the initiator has the keys, after which both sides use the new inbound and outbound SAs.

Go deeper

The three messages

Msg	Direction	Payloads
1	initiator to responder	HASH(1), SA proposals with initiator SPI, nonce, optional KE, proxy IDs
2	responder to initiator	HASH(2), chosen SA with responder SPI, nonce, optional KE, proxy IDs
3	initiator to responder	HASH(3)

Keys

IPsec keys are derived from the phase 1 key material (SKEYID_d) plus both nonces and the SPI, or also from a fresh DH secret when PFS is on.

SPIs

Each side chooses the SPI for its own inbound SA and tells the peer, so the outbound SPI on one router is the inbound SPI on the other.

One quick mode per selector pair

A crypto ACL with three lines to three remote subnets triggers three quick modes and three SA pairs, and each pair is rekeyed separately.

They will ask next

What if my crypto ACL is wider than what the peer proposes?
Many implementations, IOS included, accept a proposal that falls inside their own policy and build the SA for exactly what was proposed. A proposal wider than the local policy is rejected. Do not rely on that behaviour, especially between vendors: mirror the selectors exactly.
Why does the third message exist?
It proves to the responder that the initiator received message 2 and derived the same keys. Until then the responder cannot be sure the initiator is ready to receive on the new SA.

Traps

Saying quick mode happens once per tunnel. It happens once per proxy ID pair and again at every rekey.

How did you do?Book 8.5 Example Systems Own page

What is IPsec anti-replay, and why can QoS cause anti-replay drops?
Say this first
Every ESP packet carries a sequence number. The receiver keeps a sliding window, 64 packets by default on IOS, and drops packets whose number it has already seen or that fall behind the window. That stops an attacker from replaying captured packets. But the sequence number is assigned at encryption, before the output queue. If QoS then sends voice ahead of queued bulk data, some bulk packets arrive more than 64 behind the newest one and are dropped as replays, even though they are genuine.
Go deeper
Other causes of reordering
Per-packet load sharing across two paths, or a provider network that reorders under load.

Evidence
IOS logs %CRYPTO-4-PKT_REPLAY_ERR with the connection ID and sequence number of the dropped packet.

Fixes on IOS
Cisco IOS
! global crypto ipsec security-association replay window-size 1024 ! or per crypto map entry crypto map VPNMAP 10 ipsec-isakmp set security-association replay window-size 1024
A wider window tolerates more reordering. Disabling the check (set security-association replay disable) works but removes the protection.
They will ask next
Why not just disable anti-replay?
It is a security control. Without it, an attacker on the path can resend captured packets and the receiver accepts them. Widen the window first, and disable only with a reason and a recorded risk decision.

What does qos pre-classify do on a tunnel?
It lets the QoS policy on the physical interface classify on the original inner header (addresses and ports), not just the outer one. The DSCP value is copied to the outer header by default, so DSCP-only policies work without it.
Traps
Assuming replay errors mean an attack. On real networks they are almost always QoS or path reordering.
How did you do?Book 8.5 Example Systems Book 6.5 Quality of Service Own page
In DMVPN phase 3, what happens when spoke A first sends traffic to a host behind spoke B?
Say this first
Spoke A has only the hub's summary, so the first packets go to the hub. The hub sees a packet arrive on Tunnel0 and leave on Tunnel0, forwards it, and sends spoke A an NHRP redirect. Spoke A sends an NHRP resolution request for the destination, which the hub forwards to spoke B. Spoke B answers spoke A directly with its public address and the matching prefix from its routing table, which brings up IPsec between the spokes. Spoke A installs a shortcut for that prefix, and later packets go spoke to spoke.
Go deeper
Walk-through with addresses
Device Tunnel NBMA LAN
Hub R1 172.16.0.1 192.0.2.1 10.1.0.0/24
Spoke A R2 172.16.0.2 198.51.100.2 10.2.0.0/24
Spoke B R3 172.16.0.3 203.0.113.2 10.3.0.0/24

R2 sends to 10.3.0.10 using the hub's summary 10.0.0.0/8 via 172.16.0.1.

R1 forwards it to R3 and, because it hairpinned on Tunnel0, sends R2 a redirect.

R2 sends a resolution request for 10.3.0.10. It is routed through R1 to R3.

R3 replies directly to R2: 10.3.0.0/24 is at 172.16.0.3, NBMA 203.0.113.2. IKE and IPsec come up between R2 and R3.

R2 installs the shortcut. On IOS 15.2 and later it appears as an NHRP route (code H, administrative distance 250), or as a next hop override (marked %) on an existing route.

Unused shortcuts age out, and traffic falls back to the hub path.

Commands
Hub: ip nhrp redirect. Spokes: ip nhrp shortcut.
They will ask next
What does traceroute show?
The first run shows the hub's tunnel address as hop 1, then spoke B. A few seconds later the same trace shows spoke B's tunnel address as hop 1.

Is the NHRP redirect the same as an ICMP redirect?
No. An ICMP redirect tells a host to use another gateway on its subnet. The NHRP redirect tells a spoke to resolve a direct path. DMVPN tunnels carry no ip redirects so the hub does not also send ICMP redirects for every hairpinned packet.
Traps
Saying spoke B's resolution reply comes back through the hub. In phase 3 it goes directly to spoke A.
How did you do?Book 3.3 Internet (IP)Own page
Which routing protocol settings does DMVPN need with EIGRP, OSPF and BGP?
Say this first
EIGRP: in phase 2, turn off split horizon and next-hop-self on the hub tunnel so spokes learn each other's prefixes with the remote spoke as next hop; in phase 3, summarize from the hub instead. Make spokes EIGRP stubs. OSPF: the default point-to-point network type on tunnels allows one neighbor, so use broadcast with spokes at priority 0 in phase 2, or point-to-multipoint in phase 3. BGP: dynamic neighbors on the hub with bgp listen range, iBGP with the hub as route reflector or eBGP with a private AS per spoke, and in phase 3 just a summary or default to the spokes.
Go deeper
EIGRP on the hub
Cisco IOS
! Phase 2 interface Tunnel0 no ip split-horizon eigrp 100 no ip next-hop-self eigrp 100 ! Phase 3 interface Tunnel0 ip summary-address eigrp 100 10.0.0.0 255.0.0.0
Spokes: eigrp stub connected under router eigrp 100.

OSPF

Point-to-point (the tunnel default) accepts one neighbor, so a hub with several spokes flaps.

Broadcast (hello 10, dead 40) keeps the next hop, needs the hub as DR.

Point-to-multipoint (hello 30, dead 120) sets the hub as next hop, fine for phase 3.

All spokes share one area, so every spoke flap triggers SPF on every spoke. This limits scale.

BGP on the hub
Cisco IOS
router bgp 65000 bgp listen range 172.16.0.0/24 peer-group SPOKES neighbor SPOKES peer-group neighbor SPOKES remote-as 65000 address-family ipv4 neighbor SPOKES activate neighbor SPOKES route-reflector-client
A route reflector does not change the next hop by default, which is what phase 2 needs.
They will ask next
Why make spokes EIGRP stubs?
When the hub loses a route it would otherwise query every spoke, and one slow spoke can cause stuck in active. Stubs are not queried. Stubs also do not re-advertise learned routes, so a dual-hub spoke never becomes a transit path between hubs.

The hub and spokes run different OSPF network types. What happens?
Broadcast and point-to-multipoint use different hello and dead timers by default (10/40 vs 30/120), so hellos do not match and no adjacency forms. Set the same type on every tunnel interface.
Traps
Summarizing on the hub in a phase 2 design. Spoke-to-spoke tunnels stop forming.
How did you do?Book 3.4 Routing Own page
How do you work out the usable MTU inside a VTI or GRE over IPsec tunnel?
Say this first
Subtract every header the tunnel adds from the underlay MTU. GRE adds 24 bytes. ESP adds 8 bytes of header, the IV, 2 bytes of trailer, the ICV and padding to the cipher block; tunnel mode adds a 20-byte outer IP header and NAT-T adds 8 bytes of UDP. With AES-256-CBC and HMAC-SHA-256 on a 1500-byte path, a VTI carries up to 1438 bytes, GRE over IPsec in transport mode 1434, in tunnel mode 1414, and in tunnel mode behind NAT only 1398. The usual ip mtu 1400 with MSS 1360 fits every case except that last one.
Go deeper
The ESP pieces (AES-256-CBC, HMAC-SHA-256)
Piece Bytes
ESP header (SPI and sequence) 8
IV 16
Pad length and next header 2
Padding 0 to 15, so payload plus trailer is a multiple of 16
ICV 16
Worked example: VTI, no NAT
1500 minus 20 (outer IP), 8 (ESP header), 16 (IV) and 16 (ICV) leaves 1440 for the encrypted part. 1440 is a multiple of 16, and 2 bytes go to the trailer, so the largest inner packet is 1438. IOS shows this as plaintext mtu 1438 in show crypto ipsec sa.

Largest inner packet on a 1500-byte underlay
Tunnel No NAT Behind NAT (NAT-T)
Plain GRE 1476 not used (PAT cannot carry GRE)
VTI (IPsec tunnel mode) 1438 1422
GRE over IPsec, transport mode 1434 1418
GRE over IPsec, tunnel mode 1414 1398
Adjustments

AES-GCM uses an 8-byte IV and pads only to 4 bytes, so it leaves slightly more room.

A PPPoE underlay is 1492, not 1500: take 8 more bytes off every number.

For GRE over IPsec in tunnel mode behind NAT, use ip mtu 1380 and ip tcp adjust-mss 1340.
They will ask next
Why does padding make the overhead variable?
CBC encrypts whole 16-byte blocks, so the payload plus the 2-byte trailer is padded up to the next multiple of 16. The overhead for a given packet depends on its length, anywhere in a 15-byte range.

Why is transport mode the better choice for GRE over IPsec here?
It drops the second 20-byte IP header. The GRE packet already says public address to public address, so the extra header buys nothing.
Traps
Quoting "IPsec adds 50 to 60 bytes" as a fixed number. It depends on cipher, integrity, mode, NAT-T and padding.
How did you do?Book 3.3 Internet (IP)Book 8.5 Example Systems Own page
What is recursive routing on a GRE tunnel, and how do you prevent it?
Say this first
It happens when the router learns the route to the tunnel destination through the tunnel itself, usually because a routing protocol running over the tunnel advertises the WAN subnets. To send a GRE packet the router routes the outer header, finds the tunnel again, and would encapsulate forever. IOS detects it, logs %TUN-5-RECURSIVEROUTING and takes the tunnel down; the routing protocol drops, the route disappears, the tunnel comes back, and it flaps. The fix: never advertise the underlay into the overlay, pin the tunnel destination with a static host route, or put the underlay in a front-door VRF.
Go deeper
Why metrics do not save you
The tunnel destination 203.0.113.2 is normally reached by a static default route. If OSPF over the tunnel advertises 203.0.113.0/30, that /30 beats the /0 by longest prefix match, whatever the administrative distance or cost.

Prevention

Advertise only LAN and tunnel subnets: precise network statements or ip ospf 1 area 0 per interface, never network 0.0.0.0 255.255.255.255 area 0.

Add a /32 static route to the tunnel destination via the ISP next hop. A /32 always wins.

Use a front-door VRF so the outer lookup happens in a separate table:
Cisco IOS
vrf definition INTERNET address-family ipv4 exit-address-family interface GigabitEthernet0/0/0 vrf forwarding INTERNET ip address 198.51.100.1 255.255.255.252 ip route vrf INTERNET 0.0.0.0 0.0.0.0 198.51.100.2 interface Tunnel0 tunnel source GigabitEthernet0/0/0 tunnel destination 203.0.113.2 tunnel vrf INTERNET

A quieter variant
Learning a default route over the tunnel that replaces the default the tunnel destination depended on causes the same loop.
They will ask next
What is the difference between the front-door VRF and the inside VRF?
The front-door VRF (tunnel vrf) is where the outer, encapsulated packets are routed. The inside VRF (vrf forwarding on the tunnel interface) is where the inner traffic is routed. The fvrf/ivrf column of show crypto ikev2 sa shows both.
Traps
Trying to fix it by raising the OSPF cost on the tunnel. Longest prefix match is checked before any metric.
How did you do?Book 3.4 Routing Own page
How would you design redundant site-to-site IPsec between a branch and two data centers?
Say this first
Two route-based tunnels from the branch, one to each data center, ideally over two ISPs, each a VTI with its own IKE and IPsec SAs. A routing protocol over both (BGP is the usual choice) makes failover a routing decision. Prefer one path with local preference or metrics, detect failure fast with BFD or tuned timers, and keep DPD on to clean up SAs. With crypto maps you only get several set peer entries and DPD-driven failover, which is slower and harder to reason about.
Go deeper
Branch with two ISPs

Tunnel1 sourced from the ISP A interface to DC1, Tunnel2 from the ISP B interface to DC2.

Pin each tunnel's underlay to its ISP: a /32 static route to each headend via the matching ISP, or one front-door VRF per ISP.

Routing

eBGP over the VTIs with private ASNs. Prefer DC1 with local preference on routes received from it, and steer return traffic with AS-path prepending or MED toward DC2.

BFD on the tunnel interfaces, where the platform supports it, gives sub-second detection. BGP timers alone take much longer.

Watch for asymmetric routing through stateful firewalls in the data centers.

Same idea elsewhere

DMVPN: two hubs, spokes with two NHS entries or two tunnels.

Cloud: an AWS Site-to-Site VPN connection provides two tunnels to different endpoints; run BGP over both.

Prove it
Test failover and failback during a change window, and watch for traffic that keeps using stale SAs.
They will ask next
Why not rely on DPD alone?
DPD only informs the crypto layer and typically takes tens of seconds. Routing still points at the dead peer unless something withdraws the route. Routing over VTIs fails over in hold time, or in BFD time.

What is reverse route injection?
With crypto maps, reverse-route installs static routes for the remote proxy subnets while the SA is up, so they can be redistributed into the IGP. When the SA goes down the routes go too, and traffic moves to the backup path.
Traps
Calling two tunnels over the same ISP and the same router redundant. Count the single points of failure.
How did you do?Book 4.1 Global Internet Own page

Device	Tunnel	NBMA	LAN
Hub R1	172.16.0.1	192.0.2.1	10.1.0.0/24
Spoke A R2	172.16.0.2	198.51.100.2	10.2.0.0/24
Spoke B R3	172.16.0.3	203.0.113.2	10.3.0.0/24

Piece	Bytes
ESP header (SPI and sequence)	8
IV	16
Pad length and next header	2
Padding	0 to 15, so payload plus trailer is a multiple of 16
ICV	16

Tunnel	No NAT	Behind NAT (NAT-T)
Plain GRE	1476	not used (PAT cannot carry GRE)
VTI (IPsec tunnel mode)	1438	1422
GRE over IPsec, transport mode	1434	1418
GRE over IPsec, tunnel mode	1414	1398

Core15

Say this first

Go deeper

Site-to-site

Remote access

Other things called a VPN

They will ask next

Traps

Say this first

Go deeper

Service by service

Why "framework"

Where you meet it

They will ask next

Traps

Say this first

Go deeper

Header

Why people use it

IOS basics

Line protocol

They will ask next

Traps

Say this first

Go deeper

How the layers fit

Modern IOS configuration

When a plain VTI is enough

They will ask next

Traps

Say this first

Go deeper

ESP packet layout

Why AH is rare

They will ask next

Traps

Say this first

Go deeper

On the wire

What changes

They will ask next

Traps

Say this first

Go deeper

On an IOS router with an outside ACL

GRE inside IPsec

They will ask next

Traps

Say this first

Go deeper

Phase 1 parameters

Phase 2 parameters

Cisco IOS defaults

Where to look

They will ask next

Traps

Say this first

Go deeper

Two kinds of SA

Lookups

The SPIs mirror between peers

Rekey

They will ask next

Traps

Say this first

Go deeper

Points to make

They will ask next

Traps

Say this first

Go deeper

IOS-XE example

Why these

They will ask next

Traps

Say this first

Go deeper

The pieces

Why not static tunnels

They will ask next