CCNA Security online course

Site-to-site IPsec

IKE, interesting traffic, and the two SAs you will debug at 2 a.m.

A site-to-site IPsec VPN encrypts traffic between two gateways. IKE (now IKEv2 in any new design) negotiates keys. ESP carries the payload. You define “interesting traffic” with an ACL or a route; packets that match get protected.

When it fails, check three things in order: phase 1 (identities, pre-shared key, proposals), phase 2 (proxy IDs / traffic selectors), then routing on both sides. A tunnel that is up with no interesting traffic is usually a selector mismatch, not an encryption bug.