VPN Configuration
IPsec building blocks
IPsec has IKE phase 1 (ISAKMP SA) and phase 2 (IPsec SA). Match proposals: encryption (AES-GCM or CBC), integrity, DH group, and lifetime; IKEv2 is preferred, while IKEv1 requires awareness of main versus aggressive mode. Authentication is pre-shared key or certificates; local and remote IDs must match the peer's expectation. Policy-based VPNs use proxy IDs/selectors; route-based VPNs use tunnel interfaces and routes.
Operational details
NAT-T encapsulates ESP in UDP 4500 when NAT is present. DPD detects dead peers. PFS adds a new DH exchange per phase 2. MTU/MSS clamping prevents large-packet black holes. NAT exemption is required so interesting traffic is not translated before entering the tunnel.
Traps
Mismatched proposals, overlapping subnets, missing route to the remote subnet, wrong proxy ID, and overly aggressive DPD timers. Also ensure the tunnel zone has policy allowing traffic in both directions.
Rule of thumb
Bring up phase 1 first (check IKE SA), then phase 2 (check IPsec SA), then the route, then policy. Phase 1 up with no traffic usually means selectors or routes are wrong.
Worked example
A site-to-site VPN shows an IKE SA but no IPsec SA: the proxy IDs differ (local 192.168.1.0/24 versus peer expecting 192.168.1.0/25). Correct the selectors, clear SAs, and retest.