Site-to-Site and Remote Access VPN Deployment Types

What it is

A VPN builds a protected path across an untrusted network, either between sites or between a user and a site.

A site to site VPN connects two networks, and the users are unaware of it. A remote access VPN connects one user device to the network, usually with client software. Cisco offers several ways to build each, and the exam asks you to choose between them.

How it works

Pick the VPN type by the topology, the scale and whether traffic needs to be routed or encrypted in groups.

Standards based IPsec

Classic IPsec uses IKE to negotiate and ESP to protect traffic. On a crypto map design, a crypto ACL selects the traffic to encrypt, so it is policy based. It works between vendors and is simple for two sites, but it is awkward for routing protocols and many sites.

Virtual tunnel interfaces (VTI)

A VTI is a routed tunnel interface that IPsec protects. Anything routed into the interface is encrypted, so routing protocols and QoS work normally. A static VTI has a fixed peer, and a dynamic VTI creates virtual access interfaces on demand for a hub with many peers.

R1(config)# crypto ikev2 keyring KR
R1(config-ikev2-keyring)# peer SITE-B
R1(config-ikev2-keyring-peer)# address 203.0.113.2
R1(config-ikev2-keyring-peer)# pre-shared-key SECRETKEY
R1(config)# crypto ikev2 profile IKEV2-PROF
R1(config-ikev2-profile)# match identity remote address 203.0.113.2 255.255.255.255
R1(config-ikev2-profile)# authentication local pre-share
R1(config-ikev2-profile)# authentication remote pre-share
R1(config-ikev2-profile)# keyring local KR
R1(config)# crypto ipsec profile IPSEC-PROF
R1(ipsec-profile)# set ikev2-profile IKEV2-PROF
R1(config)# interface Tunnel0
R1(config-if)# tunnel source GigabitEthernet0/0
R1(config-if)# tunnel destination 203.0.113.2
R1(config-if)# tunnel mode ipsec ipv4
R1(config-if)# tunnel protection ipsec profile IPSEC-PROF

This is an IOS XE static VTI outline. A custom transform set can also be attached to the IPsec profile.

SSL VPN

SSL VPN, in current Cisco designs, means remote access using TLS, or DTLS for better performance, from Cisco Secure Client. The headend is usually a Cisco Secure Firewall or ASA. The ASA also offers a clientless mode that gives web based access to some resources without installing software.

SSL VPN passes through most firewalls and NAT, because it looks like web traffic on TCP 443. Remote access can also use IPsec with IKEv2 from the same client.

DMVPN

Dynamic Multipoint VPN builds a hub and spoke design that can create spoke to spoke tunnels on demand. It combines four parts.

• mGRE: one tunnel interface that can reach many peers.
• NHRP: maps tunnel addresses to public addresses, so spokes find each other.
• IPsec: protects the tunnels.
• A routing protocol: EIGRP, OSPF or BGP distributes the routes.

DMVPN scales well because the hub needs no per spoke configuration. It runs in phases. Phases 2 and 3 allow spoke to spoke tunnels, and phase 3 also allows route summarisation at the hub.

FlexVPN

FlexVPN is a Cisco framework built on IKEv2. It gives one consistent configuration model for site to site, remote access, hub and spoke and spoke to spoke. It uses smart defaults and supports AAA based authorization, so policy can come from a RADIUS server.

GETVPN

Group Encrypted Transport VPN secures traffic for a group of routers that share a key. It is tunnel-less, so the original IP header is kept and routing and multicast are not changed. It suits private WANs such as MPLS, where the underlay already provides connectivity.

Comparison