IPsec is the common protocol for site-to-site VPNs, connecting two sites across a non-private network such as the internet through a secure virtual tunnel. section 16.3.1 section 16.4
The tunnel is virtual rather than physical: packets still cross the internet, but IPsec protects them before transmission. The sending router encrypts the original packet, encapsulates it with an IPsec header and a new IP header, and forwards it to the peer router. The receiving router de-encapsulates, decrypts, and forwards the original packet. section 16.3.1 section 16.4
Key operational characteristics include:
- Provides a permanent virtual connection between two configured devices; it remains until the relevant configurations are removed. section 16.3.1
- Protects traffic between sites without requiring individual hosts to create VPNs; hosts send data to their local router for encryption. section 16.3.1
- Supports unicast traffic only. GRE over IPsec adds GRE’s support for broadcast, multicast, and other traffic while retaining IPsec encryption. section 16.4
- Uses DMVPN to reduce the labor and configuration-error risk of manually building a full mesh; a configured hub-and-spoke design can form the mesh dynamically. section 16.4
Router-to-router packet flow
R1 receives a packet destined for a remote server, encrypts it, and places it inside a new packet addressed to R2. R2 removes the outer encapsulation, decrypts the inner packet, and forwards it to the server. section 16.3.1
Figure 16.15 Tunneling an IP packet with IPsec. The IP packet is encrypted, encapsulated with an IPsec header and a new IP header, and then forwarded.
Use the packet diagram to trace encryption, IPsec encapsulation, new IP addressing, and forwarding. section 16.3.1
