A site-to-site VPN connects two geographically separate sites across a non-private network such as the public internet. It uses a persistent virtual tunnel between gateway routers so hosts at either site can communicate securely without running VPN software themselves. section 16.3.1 section 16.3.2
Core behavior and exam-relevant characteristics:
- Uses IPsec most commonly to encrypt traffic and create a secure virtual pathway between the two gateway devices. section 16.3.1
- Keeps the tunnel active until the relevant router configurations are removed, making it suitable for permanent site connectivity. section 16.3.1
- Encrypts the original packet, encapsulates it with an IPsec header and a new IP header, and sends it through the public network. section 16.3.1 section 16.4
- Supports many hosts within the connected sites, unlike a remote access VPN, which creates a separate tunnel for each end-user device. section 16.3 section 16.3.2
- Carries unicast traffic with IPsec; combines GRE with IPsec when broadcast or multicast support is required. section 16.4
- Uses DMVPN to reduce the labor and configuration-error risk of manually building a full mesh of IPsec tunnels. section 16.4
Packet flow between two sites
R1 receives a packet destined for SRV1, encrypts it, and encapsulates it inside a new packet addressed to R2. R2 de-encapsulates and decrypts the packet, then forwards it to SRV1. The physical bits still cross the internet; the tunnel is a virtual pathway rather than a new physical route. section 16.3.1
Figure 16.14 A tunnel is created by encapsulating a packet inside of another packet. This outer packet provides a “tunnel” for the inner packet to travel through without being exposed to the internet.
Visualizes tunneling as an inner packet encapsulated inside an outer packet, clarifying how traffic crosses the public network without exposing the inner packet. section 16.3.1
