Site-to-site and remote-access VPNs

A real-life situation

The company opens a branch office in another city. Branch staff need the file server and the business apps at headquarters (HQ). A private leased line between the two sites would cost a lot every month. Both sites already have cheap internet connections. And a sales rep working from home also needs the same apps.

The internet is not private: anyone on the path could read or change the packets. The answer is a virtual private network (VPN): a protected tunnel across the internet. You met the basic idea in VPN basics. This lesson looks at the two kinds the CCNA exam asks about.

What site-to-site and remote-access VPNs are

A VPN gateway is the device that ends a tunnel, encrypts and decrypts traffic, and passes it to the local network. In the lab R1 is the HQ gateway for both kinds of VPN. In many companies the remote-access users connect to a firewall instead; the idea is the same.

IPsec

IPsec is a set of open standards for protecting IP packets. It gives four protections:

• Confidentiality: the data is encrypted (for example with AES), so no one on the path can read it.
• Integrity: a keyed hash (for example SHA-256) shows if anyone changed a packet on the way.
• Authentication: each gateway proves who it is, with a pre-shared key or a certificate.
• Anti-replay: sequence numbers stop an attacker from re-sending captured packets.

TLS for remote access

Many remote-access VPNs use TLS, the same protocol that protects HTTPS (see HTTPS and TLS). TLS runs on TCP port 443, which almost every hotel or café network allows, so it connects from nearly anywhere. There are two styles:

• Client-based: an app such as Cisco Secure Client (formerly AnyConnect) builds a full tunnel. The laptop behaves as if it were on the company network.
• Clientless: the user opens a web portal in a browser and reaches only selected web apps through it. No software is installed.

Why it works that way

A site-to-site VPN is built between gateways so that hosts don't have to change. Hundreds of PCs at a branch keep using their default gateway as normal. Only the edge routers know about the tunnel. That is why it suits fixed offices.

A remote-access VPN must work for one person who moves between home, hotel and airport networks, often behind NAT and strict firewalls. So the tunnel starts on the device itself, the user has to log in (often with multi-factor authentication), and TLS on port 443 is a popular choice because it is rarely blocked.

Both types wrap the original packet inside a new one. The outer packet carries public addresses that can be routed on the internet. The inner packet keeps its private addresses, which only matter once it reaches the other side.

How it works step by step

Building the tunnel: IKE

Before any data is protected, the two gateways must agree how to encrypt and must share secret keys. They use IKE (Internet Key Exchange, UDP port 500) to do this. The result is a set of security associations (SAs): agreed settings and keys for each direction. With IKE version 2 the exchange is short:

Older configurations use IKE version 1, which does the same job in two phases: phase 1 builds the protected management channel and phase 2 builds the IPsec SAs. You will see both names in the field. If either gateway is behind a NAT device, IKE detects it and moves to UDP port 4500, wrapping ESP inside UDP so NAT can handle it (NAT traversal).

Sending data: ESP in tunnel mode

IPsec carries data with ESP (Encapsulating Security Payload, IP protocol 50). Between gateways it runs in tunnel mode: the whole original packet, header and all, is encrypted and placed inside a new packet.

1. The HQ PC sends a packet to 192.168.50.20 through its default gateway, R1.
2. R1 checks its rules. Traffic from 192.168.10.0/24 to 192.168.50.0/24 must be protected.
3. If no tunnel exists yet, R1 builds one with IKE. The first packet or two may be lost while that happens.
4. R1 encrypts the packet, adds the ESP header and trailer and a new IP header, and sends it to 198.51.100.1.
5. BR1 checks the integrity value and sequence number, decrypts the packet, removes the outer header and routes the original to the branch PC.

How to configure it on Cisco IOS

⚠️ Based on Cisco IOS documentation, not run on a lab device. The CCNA exam only asks you to describe VPNs. This classic IKEv1 crypto map example is here so you can recognise the parts; newer designs often use IKEv2 or tunnel interfaces instead.

A full example for R1

If R1 also gives the HQ LAN internet access with PAT, the NAT rule must skip HQ-to-branch traffic. Otherwise NAT changes the source address first and the packet no longer matches the VPN rule. See PAT (NAT overload) for the NAT side.

How to verify it

R1#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
198.51.100.1    203.0.113.1     QM_IDLE           1001 ACTIVE

R1#show crypto ipsec sa
interface: GigabitEthernet0/1
    Crypto map tag: HQ-VPN, local addr 203.0.113.1

   local  ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.50.0/255.255.255.0/0/0)
   current_peer 198.51.100.1 port 500
    #pkts encaps: 120, #pkts encrypt: 120, #pkts digest: 120
    #pkts decaps: 118, #pkts decrypt: 118, #pkts verify: 118
    ...

R1#ping 192.168.50.20 source GigabitEthernet0/0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.50.20, timeout is 2 seconds:
Packet sent with a source address of 192.168.10.1
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 20/22/24 ms

What goes wrong and how to troubleshoot it

Common mistakes

• Thinking a VPN hides everything. Outsiders still see the two gateways' public addresses and how much traffic flows. What they can't see is the inner packets.
• Mixing up the two types. Site-to-site connects networks and needs no software on hosts; remote access connects one device and needs a client (or a browser for clientless).
• Forgetting the far side. Every setting on R1 needs a matching (mirrored) setting on BR1.
• Assuming IPsec carries routing protocols. Plain IPsec doesn't carry multicast; that is what GRE over IPsec is for.

💡 Exam tip: the exam tests description, not configuration. Be ready to say which VPN type fits a scenario (offices = site-to-site, travelling users = remote access), that site-to-site is usually IPsec and remote access is often TLS with a client such as Cisco Secure Client (AnyConnect), and what IPsec provides: confidentiality, integrity, authentication and anti-replay. Know that clientless remote access uses only a web browser.

Key takeaways

• A VPN builds a protected tunnel across an untrusted network like the internet.
• Site-to-site joins whole networks between gateways; hosts don't know it exists.
• Remote access joins one device, with client software or a browser.
• IPsec uses IKE to agree keys and ESP to encrypt; tunnel mode wraps the whole original packet.
• TLS-based remote access runs on TCP 443 and works through most networks.

Check yourself