Close this search box.

How To Configure IPsec Tunnel On Cisco Router?

how to configure ipsec tunnel on cisco router

Unlock the secrets of How To Configure IPsec Tunnel On Cisco Router. our step-by-step guide. Simplify complex networking tasks and ensure secure connections effortlessly.


In this comprehensive guide, we’ll show you how to configure an IPsec tunnel on your trusty Cisco router. Navigating the intricacies of network security can be daunting, but fear not. Whether you’re a seasoned IT professional or just beginning to explore the world of networking, this step-by-step tutorial will provide you with the knowledge and confidence you need to establish a secure and reliable connection, regardless of your level of experience. Prepare your network for robust security features that an IPsec tunnel can provide. Let’s get started!

What is an IPsec Tunnel?

As a cornerstone of secure communication across the digital landscape, the IPsec tunnel holds significant weight in the world of network security. But what is an IPsec tunnel exactly, and why is it so vital in today’s interconnected world?

Understanding the Basics

This method enables the secure communication of two networks over the internet through a virtual, encrypted conduit. IPsec tunnels, short for Internet Protocol Security tunnels, are used to secure the communication between two networks. Specifically, this technology is critical for organizations and businesses that require secure and private connections between their offices or with remote workers.

The Anatomy of an IPsec Tunnel

The IPsec tunnel ensures the confidentiality, integrity, and authenticity of data by combining protocols with cryptographic techniques. The authentication header (AH) and the encapsulating security payload (ESP) are the main components that accomplish this.

The Authentication Header authenticates the sender and verifies that the data has not been tampered with during transit. On the other hand, the Encapsulating Security Payload provides encryption, safeguarding the content of the communication from prying eyes.

How To Configure IPsec Tunnel On Cisco Router?
How To Configure IPsec Tunnel On Cisco Router?

Use Cases and Benefits

An IPsec tunnel can be used in a variety of situations, including establishing secure links between a company’s branch offices, which allows seamless data exchange and collaboration. Aside from providing remote workers with secure access to the organization’s resources, they also play an important role in ensuring an organization’s security.

There are a number of benefits to utilizing IPsec tunnels. Additionally, they provide a cost-effective solution for organizations looking to maintain secure connections without the need for dedicated leased lines, as they provide a robust defence against eavesdropping, data tampering, and other malicious activities.

Configuring an IPsec Tunnel

Although IPsec tunnels may seem complex, they can be easily configured by following a well-documented process. The majority of network devices, including Cisco routers, are equipped with user-friendly interfaces that simplify the setup process. However, it is crucial to ensure compatibility between the devices involved and follow best practices.

How to configure IPsec tunnel on Cisco router?

Configuring an IPsec tunnel on a Cisco router is an essential step in fortifying your network’s security. This robust technology establishes a secure channel for data transmission, ensuring that sensitive information remains shielded from potential threats. In this guide, we will delve into a step-by-step process, drawing information from Cisco’s official documentation to provide you with the most accurate and reliable instructions.

Router A

!— Establish an ISAKMP policy for Phase 1 of the L2L tunnel negotiations.

Policy 10 of the crypto isakmp

Cryptography based on AES

The hash value is sha256

An authentication process prior to sharing

The 14th group

!— Provide the remote peer’s address and the pre-shared key

!— Matching the tunnel for L2L.

The crypto isakmp key for the VPN user address is

!— Develop the IPsec negotiation policy for Phase 2.

Ipsec transform-set encryption esp-aes encryption esp-sha256-hmac

!— Encrypt the traffic by creating an ACL.

!— In this example, the traffic from to

!— is encrypted. The traffic which does not match the access list 

!— is unencrypted for the Internet.

The access-list 100 permits the following IP addresses:

!— Create the actual crypto map. Specify an access control list (ACL),

!— specifies the proxy’s identity (local and remote host/networks).

crypto map mymap 10 ipsec-isakmp

Set peer

Set transform-set myset

Match address 100

interface GigabitEthernet0/1

ip address

!— The crypto map should be applied to the outside interface.

interface GigabitEthernet0/0

 ip address

 crypto map mymap

!— Set the default gateway as the default route

ip route

Router B

!— Establish an ISAKMP policy for Phase 1 of the L2L tunnel negotiations.

Policy 10 of the crypto isakmp

Cryptography based on AES

The hash value is sha256

An authentication process prior to sharing

14th Group

!— Specify the pre-shared key and the remote peer address

!— to match for the L2L tunnel.

crypto isakmp key vpnuser address

!— Create the Phase 2 policy for IPsec negotiation.

crypto ipsec transform-set myset esp-aes esp-sha256-hmac

!— Create an ACL for the traffic to be encrypted.

!— In this example, the traffic from to

!— is encrypted. The traffic which does not match the access list 

!— is unencrypted for the Internet.

access-list 100 permit ip

!— Create the actual crypto map. Specify an access control list (ACL),

!— which defines the proxy identities (local and remote host/networks).


crypto map mymap 10 ipsec-isakmp

 set peer

 set transform-set myset

 match address 100

interface GigabitEthernet0/1

ip address


!— Apply the crypto map on the outside interface.

interface GigabitEthernet0/0

ip address

crypto map mymap

!— Route to the default gateway.

ip route 10.0.01


This section is essential to verify your configuration is functioning properly. The Cisco CLI Analyzer is available exclusively to registered customers and supports specific show commands. With the Cisco CLI Analyzer, you can analyze the output of the show command in order to ensure that your IPsec tunnel is functioning properly.

How To Configure IPsec Tunnel On Cisco Router?
How To Configure IPsec Tunnel On Cisco Router?

show crypto IPsec sa – 

A detailed view of IPsec Security Associations (SAs) is provided by this command, including information such as settings, packets that have been encapsulated and decapsulated, local and remote proxy identities, and Security Parameter Indexes (SPIs) for both inbound and outbound traffic.

  • RouterA#show crypto ipsec sa
  • interface: Serial2/0
  • Crypto map tag: mymap, local addr
  • protected vrf: (none)
  • local ident (addr/mask/prot/port): (
  • remote ident (addr/mask/prot/port): (
  • current_peer port 500
  • PERMIT, flags={origin_is_acl,}
  • #pkts encaps: 21, #pkts encrypt: 21, #pkts digest: 21
  • #pkts decaps: 21, #pkts decrypt: 21, #pkts verify: 21
  • #pkts compressed: 0, #pkts decompressed: 0
  • #pkts not compressed: 0, #pkts compr. failed: 0
  • #pkts not decompressed: 0, #pkts decompress failed: 0
  • #send errors 0, #recv errors 0
  • local crypto endpt.:, remote crypto endpt.:
  • plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0
  • current outbound spi: 0x8767D399(2271728537)
  • PFS (Y/N): N, DH group: none

show crypto isakmp sa – 

A comprehensive list of all current IKE Security Associations (SAs) is provided in this command, along with their status and details about the source and destination.

  • RouterA#show crypto isakmp sa
  • dst             src             state          conn-id slot status
  •      QM_IDLE              1    0 ACTIVE

show crypto map – 

The crypto map structure is displayed by this command, which includes critical information such as the name, sequence number, peer address, applied ACLs, and details about the IPsec transform set used.

  • RouterA#show crypto map
  • Crypto Map IPv4 “mymap” 10 ipsec-isakmp
  • Peer =
  • Extended IP access list 100
  • access-list 100 permit ip
  • Current peer:
  • Security association lifetime: 4608000 kilobytes/3600 seconds
  • Responder-Only (Y/N): N
  • PFS (Y/N): N
  • Mixed-mode : Disabled
  • Transform sets={
  •     myset: { esp-aes esp-sha256-hmac }
  • }
  • Interfaces using crypto map mymap:
  • GigabitEthernet0/0

show crypto session remote <IP address of peer VPN endpoint> detail – 

This command provides a detailed overview of the crypto session’s current status, including the session’s uptime, IKEv1 SA details, and IPsec flow details.

  • RouterA#show crypto session remote detail
  • Crypto session current status
  • Interface: GigabitEthernet0/0
  • Uptime: 00:39:16
  • Session status: UP-ACTIVE   >>>>> Status of the VPN 
  • Peer: port 500 fvrf: (none) ivrf: (none)
  • Phase1_id:
  • Desc: (none)
  • Session ID: 0
  • IKEv1 SA: local remote Active
  • Capabilities:(none) connid:1004 lifetime:23:20:43
  • IPSEC FLOW: permit ip
  • Active SAs: 2, origin: crypto map
  • Inbound:  #pkts dec’ed 21 drop 0 life (KB/Sec) 4338240/1243
  • Outbound: #pkts enc’ed 21 drop 0 life (KB/Sec) 4338240/1243

Using these show commands in your Cisco CLI Analyzer, you can effectively monitor and verify the operation of your IPsec tunnel configuration and ensure that it is secure and operational as intended.


What is IPsec configuration?

Internet Protocol Security, also known as IPSec, is a set of communication protocols designed to establish secure connections between networks over the Internet. In the Internet, the Internet Protocol (IP) is the universal framework governing data transmission. By introducing encryption and authentication measures, IPSec significantly improves the security of this protocol.

Which port is required for the IPsec tunnel?

To establish L2TP/IPsec VPN connections, it’s crucial to configure your network to allow specific ports:

UDP port 500: Used for Internet Key Exchange (IKE) traffic.
UDP port 4500: Facilitates IPsec control path.
UDP port 1701: Necessary for L2TP traffic.
IP protocol 50 (ESP): Handles IPsec Encapsulating Security Payload traffic.

Keep in mind that for PPTP, Protocol 47 (GRE) is employed, rather than Port 47. This differentiation is essential for proper network configuration.

How to check the IPsec tunnel in Cisco ASA?

ASA#show vpn-sessiondb detail l2l displays information about the currently active tunnels and their respective information. This command is intended solely for providing information regarding live connections.

How do I start a tunnel in Cisco ASA?

Please take note: On the ASA, you can employ the packet-tracer tool to simulate traffic and test the IPSec tunnel. For instance, you can use a command like “packet-tracer input inside tcp 12345 192.168.” This allows you to initiate the IPSec tunnel for testing purposes.

How do I test my IPsec tunnel?

The simplest way to verify an IPsec tunnel is by initiating a ping from one client station located behind the firewall to another on the opposite side. When this ping is successful, it confirms that the tunnel is operational and functioning correctly.


To strengthen network security, it is imperative that users configure an IPsec tunnel on their Cisco router. This comprehensive process, outlined in this guide, enables users to create a secure data transmission channel. The Cisco routers provide powerful capabilities that allow organizations and individuals to confidently navigate the complex nature of network security by following the steps and utilizing the powerful capabilities provided by Cisco routers. As a result of the IPsec tunnel, sensitive information remains safeguarded, ensuring a resilient defence against potential threats in today’s interconnected digital environment.

5/5 - (1 vote)

Leave a Comment

Follow Us on Social Media
Top Featured Products