VPNs and site-to-site IPsec: types, framework and configuration

Why use a VPN?

• Cost savings: the internet replaces expensive private lines.
• Security: encryption and authentication protect the traffic.
• Scalability: new sites and users are added easily.
• Compatibility: works over almost any internet connection.

Two types of VPN

• Site-to-site: VPN gateways (routers or firewalls) at each site build a permanent tunnel. Users don't need any VPN software; their traffic is encrypted automatically when it leaves the site.
• Remote-access: a VPN client on a laptop or phone builds a tunnel to the organisation's VPN gateway whenever the user needs it. It uses IPsec or SSL/TLS.

The IPsec framework

IPsec is a framework: each building block can use a choice of algorithms.

How a tunnel is built

1. Interesting traffic: a host sends traffic that matches the VPN's access list, which triggers the tunnel.
2. IKE phase 1: the two gateways authenticate each other and agree a secure management channel (the ISAKMP/IKE security association).
3. IKE phase 2: inside that channel they agree how to protect user data, creating the IPsec security associations.
4. Data transfer: traffic is encrypted and sent through the tunnel.
5. Termination: the tunnel closes when its lifetime ends or traffic stops.

Configuration tasks

1. Configure the ISAKMP policy for IKE phase 1.
2. Configure the IPsec transform set for phase 2.
3. Create a crypto map tying the peer, transform set and traffic list together.
4. Apply the crypto map to the outside interface.
5. Verify that the tunnel is working.

crypto isakmp policy 10
 encryption aes 256
 hash sha256
 authentication pre-share
 group 14
 lifetime 3600
crypto isakmp key Long-Random-PSK-2026 address 203.0.113.2
crypto ipsec transform-set FMT-TS esp-aes 256 esp-sha256-hmac
crypto ipsec security-association lifetime seconds 900
access-list 110 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
crypto map FMT-MAP 10 ipsec-isakmp
 set peer 203.0.113.2
 set transform-set FMT-TS
 match address 110
interface GigabitEthernet0/1
 crypto map FMT-MAP

Verification commands are on the router commands page. For a deeper explanation, read IPsec explained.

Real-world example: a chain of twelve shops

A family-owned chain of twelve hardware shops needed its tills and stock system to talk to the head office server. Leased lines to every shop were too expensive, so each shop got an ordinary business broadband line and a small firewall. The firewalls build site-to-site IPsec tunnels to the head office, using IKEv2, AES encryption and SHA-256 integrity, so till data crosses the internet encrypted. Area managers who visit shops use a remote-access VPN client with MFA on their laptops.

When one shop's broadband failed, its firewall switched to a 4G backup link and rebuilt the tunnel automatically, and the tills kept working. The IT team monitors each tunnel's status, so they knew about the failover before the shop called.