What Is a Site-to-Site VPN? IPsec and Alternatives

A site-to-site VPN (IPsec) connects two sites (headquarters and branch office, or data center and cloud) over the Internet with end-to-end encryption. It is a cost-effective alternative to dedicated MPLS and supports interoperability across vendors through IKEv2. This guide provides a definition and example.

How It Works

• 2 firewalls/routers configured as peers
• An encrypted ESP IPsec tunnel between them
• LAN-to-LAN traffic passes through the tunnel
• Transparent to endpoints

Components

• Phase 1 (IKE): peer authentication and secure channel establishment
• Phase 2 (IPsec): SA for data encryption/decryption
• Proposals: encryption algorithms (AES-GCM 256) and integrity algorithms (SHA-384)
• PSK (Pre-Shared Key) or certificates
• Proxy IDs: authorized IP addresses/subnets

Use Cases

• Headquarters ↔ branch office (permanent connectivity)
• Corporate network ↔ cloud (AWS, Azure)
• Interconnected multi-site environments (hub-and-spoke or mesh)
• MPLS replacement
• B2B connectivity (industrial partners)

Recommended Algorithms for 2026

• IKEv2 required (not IKEv1)
• Phase 1: AES-256-GCM + SHA-384 + DH 19 (ECP-256)
• Phase 2: ESP AES-256-GCM + PFS DH 19
• Avoid: DES, 3DES, SHA-1, MD5

Topologies

• Point-to-point: 2 sites
• Hub-and-spoke: all sites connect to headquarters
• Full mesh: N(N-1)/2 tunnels; does not scale beyond 15 sites
• ADVPN/DMVPN: dynamic, on-demand inter-spoke tunnels

Order from OPTINOC

Multi-vendor IPsec VPN: FortiGate, Cisco, Palo Alto, Juniper, and pfSense. Turnkey configuration. Quote within 2 hours.