In a site-to-site VPN, edge routers at each location build an IPsec tunnel over the internet so private subnets can communicate securely as if they were on one LAN. This guide covers the reference topology, recommended IKEv2/IPsec proposals, NAT Traversal, routing options, and a step-by-step configuration on Cisco IOS and Ubiquiti EdgeRouter, plus best practices and troubleshooting.
Reference Topology: Two Sites, Edge Routers, and IP Ranges
Site A: 10.1.0.0/16 (Edge Router public IP A.A.A.A) ↔ Internet ↔ Site B: 10.2.0.0/16 (Edge Router public IP B.B.B.B). If either router is behind NAT, enable NAT-T (UDP/4500). Allow UDP/500 (IKE) and UDP/4500 (NAT-T) through firewalls.
Traffic selectors (also called proxy IDs or crypto ACLs) limit what traverses the tunnel. Example: 10.1.0.0/16 ↔ 10.2.0.0/16. Add more subnets by adding additional selectors on both sides.
IPsec Building Blocks: IKEv2, Proposals, and NAT‑T
Recommendations for modern deployments:
- Use IKEv2 (faster rekeys, better mobility) with AES‑256‑GCM if supported, or AES‑256‑CBC + SHA2‑256.
- DH Group: 14 (2048-bit) or 19 (ECC). Enable PFS (same group as Phase 1).
- SA lifetimes: IKE 8h; IPsec/ESP 1h (adjust for load).
- DPD (Dead Peer Detection) on; NAT‑T auto; clamp MSS if PMTUD fails (1360–1380 typical).
Deep dive specs: RFC 4301: Security Architecture for the Internet Protocol.
Configuration Example: Cisco IOS (Site A)
Replace A.A.A.A/B.B.B.B and the local/remote subnets for your environment.
! Phase 1 (IKEv2)
crypto ikev2 proposal IKEV2-PROP
encryption aes-cbc-256
integrity sha256
group 14
!
crypto ikev2 policy 10
proposal IKEV2-PROP
!
crypto ikev2 keyring S2S-RING
peer SITEB
address B.B.B.B
pre-shared-key MyS2S-Strong-PSK
!
crypto ikev2 profile S2S-PROFILE
match identity remote address B.B.B.B 255.255.255.255
authentication remote pre-share
authentication local pre-share
keyring local S2S-RING
dpd 10 5 on-demand
!
! Phase 2 (IPsec/ESP)
crypto ipsec transform-set TS-ESP esp-aes 256 esp-sha256-hmac
mode tunnel
!
crypto ipsec profile IPSEC-PROFILE
set transform-set TS-ESP
set pfs group14
!
! Traffic selectors (crypto ACL)
ip access-list extended S2S-SELECTORS
permit ip 10.1.0.0 0.0.255.255 10.2.0.0 0.0.255.255
!
! Tunnel interface (preferred) or crypto map
interface Tunnel10
ip address 169.254.10.1 255.255.255.252
tunnel source A.A.A.A
tunnel destination B.B.B.B
tunnel protection ipsec profile IPSEC-PROFILE
!
! NAT exemption for VPN traffic (if NAT is used)
ip access-list extended NAT-EXEMPT
deny ip 10.1.0.0 0.0.255.255 10.2.0.0 0.0.255.255
permit ip any any
!
route-map NO-NAT permit 10
match ip address NAT-EXEMPT
!
interface GigabitEthernet0/0
ip nat outside
ip virtual-reassembly in
!
interface GigabitEthernet0/1
ip nat inside
!
! Apply NO-NAT to inside if using policy NAT
ip nat inside source route-map NO-NAT interface GigabitEthernet0/0 overload
!
! Static route to remote subnet via tunnel
ip route 10.2.0.0 255.255.0.0 169.254.10.2Configuration Example: Ubiquiti EdgeRouter (Site B)
CLI example using IKEv2 with strong suites and NAT‑T:
configure
set vpn ipsec ike-group IKEv2 proposal 1 encryption aes256
set vpn ipsec ike-group IKEv2 proposal 1 hash sha256
set vpn ipsec ike-group IKEv2 dh-group 14
set vpn ipsec ike-group IKEv2 dead-peer-detection action restart
set vpn ipsec ike-group IKEv2 dead-peer-detection interval 15
set vpn ipsec ike-group IKEv2 dead-peer-detection timeout 30
set vpn ipsec esp-group ESP proposals 1 encryption aes256
set vpn ipsec esp-group ESP proposals 1 hash sha256
set vpn ipsec esp-group ESP pfs enable
set vpn ipsec esp-group ESP lifetime 3600
set vpn ipsec site-to-site peer A.A.A.A authentication mode pre-shared-secret
set vpn ipsec site-to-site peer A.A.A.A authentication pre-shared-secret MyS2S-Strong-PSK
set vpn ipsec site-to-site peer A.A.A.A ike-group IKEv2
set vpn ipsec site-to-site peer A.A.A.A esp-group ESP
set vpn ipsec site-to-site peer A.A.A.A local-address B.B.B.B
set vpn ipsec site-to-site peer A.A.A.A tunnel 1 local prefix 10.2.0.0/16
set vpn ipsec site-to-site peer A.A.A.A tunnel 1 remote prefix 10.1.0.0/16
set vpn ipsec site-to-site peer A.A.A.A nat-traversal enable
commit; saveVendor guide: EdgeRouter IPsec configuration.
Routing: Static, OSPF, or BGP over the Tunnel
Start with static routes for a two-site link. For multi-site or failover, run OSPF/BGP over a tunnel interface. If large payload apps drop or stall, set TCP MSS clamp (e.g., 1360–1380) on WAN to avoid fragmentation when ESP adds overhead.
Security Best Practices for Site-to-Site IPsec
- Prefer certificates over PSKs where possible; rotate PSKs regularly.
- Disable weak suites (3DES/MD5/DES). Use AES‑GCM or AES‑CBC + SHA2‑256.
- Enable PFS, DPD, and aggressive logging for negotiation failures.
- Restrict traffic selectors to required subnets/ports only.
- Monitor tunnel uptime and SA rekeys; export logs to SIEM.
Troubleshooting Checklist (Phase 1/2, NAT‑T, MTU)
- Phase 1 (IKE) down: Proposal mismatch, wrong PSK/cert, clock drift, UDP/500 blocked.
- Phase 2 (IPsec) down: Traffic selectors don’t match on both sides; PFS group mismatch; UDP/4500 blocked when behind NAT.
- No traffic across: Missing static route/dynamic routing; NAT exemption missing; firewall rules blocking inter-site subnets.
- Intermittent drops: MTU/PMTUD issues → clamp MSS; lifetimes too short; DPD timers too aggressive.
FAQ
Can I use dynamic public IPs? Use DDNS and IKEv2 IDs based on FQDN, or a hub site with a static IP.
Can I include multiple subnets? Yes—add each pair to the selectors/crypto ACLs on both peers.
Is split tunneling possible? For site‑to‑site, it’s defined by selectors (only specific subnets are encrypted).
Conclusion
A site‑to‑site VPN between edge routers lets your branch and HQ subnets communicate securely over the internet. Follow strong IKEv2/IPsec proposals, define precise traffic selectors, enable NAT‑T when needed, and choose routing that matches your scale. See also our security guide on installing free SSL certificates for adjacent best practices.
Further reading: Cisco IPsec site‑to‑site overview.
