Site-to-Site IPsec VPN: Detailed Configuration

April 15, 2026·3 min read·596 words

A site-to-site IPsec VPN is the standard technology for securely interconnecting 2 sites over the Internet while ensuring confidentiality and integrity. It is compatible with all vendors (Cisco, FortiGate, Palo Alto, pfSense, Juniper). This guide covers IKEv1/v2, Phase 1/Phase 2, algorithms recommended for 2026, multi-vendor configurations, and troubleshooting.

IPsec Overview

Protocol: ESP (Encapsulating Security Payload) for encryption + integrity
AH (Authentication Header): integrity only, rarely used
Modes: Tunnel (standard site-to-site) or Transport (host-to-host)
Ports: UDP 500 (IKE), UDP 4500 (NAT-T), ESP (IP protocol 50)

IKE (Internet Key Exchange)

IKEv1

2 distinct phases
Main Mode (6 messages) or Aggressive Mode (3 messages, less secure)
Legacy, but still supported for compatibility

IKEv2 (recommended)

RFC 7296, 2014
Only 4 messages
Supports EAP (certificate or username/password authentication)
Native Dead Peer Detection (DPD)
Mobility (MOBIKE): the client can change its IP address without renegotiation
Recommendation: always use IKEv2 in 2026

Phase 1 (IKE SA)

Establishes a secure channel for negotiating Phase 2:

Authentication: pre-shared key (PSK) or X.509 certificates
Encryption: AES-256-GCM (recommended), AES-256-CBC (legacy)
Integrity: SHA-256 or SHA-384 (SHA-1 deprecated)
DH Group: 14 (2048 bit) minimum; 19 (ECP-256) or 20 (ECP-384) recommended
Lifetime: 86400s (1 day) is typical

Phase 2 (IPsec SA)

Negotiates encryption parameters for data traffic:

Encryption: AES-256-GCM (recommended)
PFS (Perfect Forward Secrecy): a DH group distinct from Phase 1
Lifetime: 3600s or rekey after 4096 KB
Proxy IDs / Traffic Selectors: IP addresses/subnets allowed through the tunnel

Recommended Cryptographic Suite for 2026

Phase 1: IKEv2, AES-256-GCM, SHA-384, DH 19 (ECP-256)
Phase 2: ESP AES-256-GCM, PFS DH 19
Avoid: DES, 3DES, MD5, SHA-1, DH 1/2/5 (<1024 bit)
See NIST SP 800-77 Rev 1 for official details

FortiGate Configuration (IKEv2)

config vpn ipsec phase1-interface
edit "VPN-PARIS-LYON"
set interface "wan1"
set ike-version 2
set peertype any
set remote-gw 203.0.113.2
set psksecret MyPresharedKey
set proposal aes256gcm-sha384
set dhgrp 19
end
config vpn ipsec phase2-interface
edit "VPN-PARIS-LYON-P2"
set phase1name "VPN-PARIS-LYON"
set proposal aes256gcm-sha384
set dhgrp 19
set src-subnet 192.168.1.0 255.255.255.0
set dst-subnet 10.10.1.0 255.255.255.0
end

Cisco IOS Configuration (IKEv2)

crypto ikev2 proposal IKEV2-PROP
encryption aes-gcm-256
integrity sha384
group 19
crypto ikev2 policy IKEV2-POL
proposal IKEV2-PROP
crypto ikev2 keyring KEYRING1
peer SITE2
address 203.0.113.2
pre-shared-key MyPresharedKey
crypto ipsec transform-set TS esp-gcm 256
mode tunnel
crypto map CMAP 10 ipsec-isakmp
set peer 203.0.113.2
set transform-set TS
match address VPN-ACL

NAT Traversal (NAT-T)

Historically, NAT disrupted IPsec because ESP does not use ports
NAT-T: encapsulates ESP in UDP 4500
Detection: both peers send NAT-D vendor IDs to determine whether NAT is present between them
Enabled by default on all modern vendors' platforms

Site-to-Site VPN vs Mesh

Hub-and-Spoke

All sites establish VPN connections only to HQ. Simple to maintain, but suboptimal for inter-site traffic.

Full Mesh

A VPN tunnel between every pair of sites. N(N-1)/2 tunnels. Does not scale beyond 10-15 sites.

ADVPN (FortiGate) / Auto-VPN (Cisco)

Inter-spoke tunnels are created dynamically on demand. Scales to 500+ sites.

SD-WAN VPN Mesh

All WAN Edges establish dynamic IPsec connections through controller orchestration. Standard practice in 2026.

Modern Alternatives

WireGuard: a simple, fast VPN that is more lightweight than IPsec
OpenVPN: SSL-based and firewall-friendly
GRE over IPsec: supports multicast/broadcast traffic
DMVPN: Cisco dynamic mesh

Troubleshooting

diagnose vpn ike gateway list (FortiGate): Phase 1
diagnose vpn tunnel list (FortiGate): Phase 2
show crypto ikev2 sa (Cisco): Phase 1
show crypto ipsec sa (Cisco): Phase 2
debug crypto ikev2 error: error-level debugging
Common issues: PSK mismatch, proposal mismatch, NAT-T not enabled, or the firewall blocking UDP 500/4500

Order from OPTINOC

Multi-vendor site-to-site IPsec configuration (FortiGate, Cisco, Palo Alto, Juniper, pfSense). Cryptographic suite audits (phasing out DES/3DES/SHA-1). ADVPN/Auto-VPN. Quote within 48 hours.