IPsec Fundamentals

0s15★ 30 XP

Lesson 127Interactive lesson

IPsec Fundamentals

A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.

Lesson format21 sections3 code blocks2 practice itemsUpdated Oct 2, 2026

The Cisco IOS IPsec configuration has a distinct four-part structure: IKE policy (Phase 1 parameters), pre-shared key, IPsec transform set (Phase 2 parameters), and crypto map (which binds the policy to interfaces and traffic). Miss any part, and the tunnel silently fails to establish.

#IKE Phase 1 and Phase 2#link

IPsec negotiation happens in two phases. Phase 1 establishes a secure channel between the two peers so they can negotiate safely. Phase 2 negotiates the actual encryption parameters for data traffic, resulting in the IPsec Security Associations.

Phase	Purpose	Parameters negotiated
IKE Phase 1	Establish secure management channel	Encryption, hash, authentication method, DH group, lifetime
IKE Phase 2	Establish data encryption SAs	Encryption, hash, mode (tunnel/transport), lifetime, PFS

Phase 1 uses Diffie-Hellman to establish a shared secret without ever transmitting it. Both peers derive the same key independently. Phase 2 reuses the secure channel from Phase 1 to negotiate the actual data encryption — this is faster because the peers trust each other after Phase 1.

callout

Both peers must have matching Phase 1 parameters (encryption, hash, auth, DH group) and matching Phase 2 parameters (encryption, hash, mode, PFS). A single mismatch and the tunnel won't establish. When troubleshooting, compare `show crypto isakmp sa` and `show crypto ipsec sa` on both ends.

#Configuring Site-to-Site IPsec#link

bash

! === Phase 1: IKE Policy ===
crypto isakmp policy 10
 encryption aes 256
 hash sha256
 authentication pre-share
 group 14
 lifetime 86400
 exit

! Pre-shared key for the peer
crypto isakmp key StrongPSK123 address 203.0.113.2

! === Phase 2: IPsec Transform Set ===
crypto ipsec transform-set TS_AES256 esp-aes 256 esp-sha256-hmac
 mode tunnel
 exit

! === Crypto ACL: which traffic to encrypt ===
ip access-list extended VPN_TRAFFIC
 permit ip 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255
 exit

! === Crypto Map: binds it all together ===
crypto map VPN_MAP 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set TS_AES256
 match address VPN_TRAFFIC
 exit

! Apply to the WAN interface
interface gigabitEthernet0/0
 crypto map VPN_MAP
 exit

The structure is: IKE policy (Phase 1 params), pre-shared key, transform set (Phase 2 params), ACL defining interesting traffic, crypto map binding it together, and application to the WAN interface. Same config on both sides, with mirrored peer addresses and matching crypto ACLs.

#Verification#link

Check IKE and IPsec SAs

root@vulnarex:~#show crypto isakmp sa

`QM_IDLE` (Quick Mode Idle) means the IKE SA is established and waiting. `ACTIVE` confirms it's usable. If the state is `MM_NO_STATE` or `MM_KEY_EXCH`, Phase 1 is still negotiating or failed — usually a parameter mismatch.

Check the data SAs

root@vulnarex:~#show crypto ipsec sa

The `#pkts encaps` and `#pkts decaps` counters confirm traffic is flowing through the tunnel. If both are zero, either no interesting traffic is being generated, or the tunnel isn't up. Check the routing first, then the crypto ACL matches.

#Troubleshooting IPsec#link

▪Tunnel won't establish — compare Phase 1 parameters on both ends
▪Phase 1 works, Phase 2 fails — check transform set, PFS, and crypto ACL symmetry
▪Ping fails but tunnel is up — check routing, crypto ACL matches, and NAT exclusions
▪NAT breaks IPsec — add `no ip nat` for traffic matching the crypto ACL, or use NAT-T
▪One-way traffic — the return crypto ACL on the far peer is likely missing

#Check Your Understanding#link

★ 15 XPmedium

exercise BLOCK (★ 15 XP)

What is the purpose of IKE Phase 1 in IPsec?

Select your proof vectors above

★ 15 XPeasy

SYNTAX VALIDATION (★ 15 XP)

Which command shows the IKE Security Associations? (three words)

root@vulnarex:~#

Press Enter to submit

#Common Mistakes#link

▪Mismatched Phase 1 or Phase 2 parameters between peers
▪Crypto ACL doesn't match the actual traffic — no interesting traffic, no tunnel
▪Missing the crypto map on the WAN interface
▪NAT interfering with tunneled traffic — add NAT exclusion for crypto ACL matches
▪Forgetting that the crypto ACL on both peers must be mirror images

Lesson completion

Ready to resolve this lesson?

Finish the lesson once you have worked through the material. This awards ★ 30 XP.

Previous lesson

Lesson tools

Workspace

0% read

Lab notes

Notes persist per lesson.

IKE Phase 1 and Phase 2 Configuring Site-to-Site IPsec Verification Troubleshooting IPsec Check Your Understanding Common Mistakes

Content

Last updated

October 2, 2026

Agent Setup

Access lesson content programmatically for AI agents, LLMs, and automated pipelines.

Fetch as Markdown (Accept header)

curl -H "Accept: text/markdown" "https://vulnarex.com/api/content/lessons?courseSlug=complete-ccna-200-301&lessonSlug=4-ipsec-fundamentals&lang=en&format=markdown"

MCP Server Config (mcp.json)

{
  "mcpServers": {
    "vulnarex": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-fetch"],
      "env": { "MCP_FETCH_URL": "https://vulnarex.com" }
    }
  }
}

MCP Server Card/.well-known/mcp.json A2A Agent Card/.well-known/agent-card.json API Catalog/.well-known/api-catalog robots.txt/robots.txt

Laboratory sanity code

Isolate active probes on matched virtual networks and keep execution streams sandboxed.

Phase

Purpose

Parameters negotiated

IKE Phase 1

Establish secure management channel

Encryption, hash, authentication method, DH group, lifetime

IKE Phase 2

Establish data encryption SAs

Encryption, hash, mode (tunnel/transport), lifetime, PFS

! === Phase 1: IKE Policy ===

crypto isakmp policy 10

encryption aes 256

hash sha256

authentication pre-share

group 14

lifetime 86400

exit

! Pre-shared key for the peer

crypto isakmp key StrongPSK123 address 203.0.113.2

! === Phase 2: IPsec Transform Set ===

crypto ipsec transform-set TS_AES256 esp-aes 256 esp-sha256-hmac

mode tunnel

exit

! === Crypto ACL: which traffic to encrypt ===

ip access-list extended VPN_TRAFFIC

permit ip 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255

exit

! === Crypto Map: binds it all together ===

crypto map VPN_MAP 10 ipsec-isakmp

set peer 203.0.113.2

set transform-set TS_AES256

match address VPN_TRAFFIC

exit

! Apply to the WAN interface

interface gigabitEthernet0/0

crypto map VPN_MAP

exit