Site-to-Site IPsec IKEv2 Route-Based VPN Tunnel Deployment

1. Scope, Architecture & Modern Cryptographic Baseline

Connecting enterprise branches, remote corporate sites, and cloud providers (Azure / AWS) requires secure, high-throughput encrypted tunnels.

This procedure establishes a Route-Based Virtual Tunnel Interface (VTI) utilizing IKEv2. Unlike legacy policy-based VPNs, route-based tunnels decouple encryption from traffic selectors, treating the tunnel as a native routable interface.

Cryptographic Baseline Specification (NIST / NSA Suite B Compliant)

Phase Parameter	Enterprise Standard Baseline	Legacy Insecure (STRICTLY BANNED)
IKE Protocol	IKEv2 (Strictly enforced)	IKEv1 (Banned)
Phase 1 Encryption	AES-256-GCM (or AES-256-CBC)	3DES, DES, Blowfish
Phase 1 Hash / PRF	SHA-384 (or SHA-256)	MD5, SHA-1
Diffie-Hellman Group	Group 19 (ECP-256) or Group 21 (ECP-384)	Group 1, Group 2, Group 5
Phase 2 Encryption	AES-256-GCM (Integrated Auth)	3DES, NULL
Perfect Forward Secrecy	PFS Enabled (DH Group 19 / 21)	PFS Disabled
Dead Peer Detection (DPD)	Enabled (Periodic 10s, Retry 3)	DPD Disabled

---

2. Reference Interconnect Topology

Parameter	Headquarters (HQ)	Branch Office (BR)
Public Gateway IP	198.51.100.1	203.0.113.1
Internal Subnet	10.10.0.0/16 (Site 10)	10.20.0.0/16 (Site 20)
Tunnel P2P Subnet	172.16.255.1 / 30	172.16.255.2 / 30
Pre-Shared Key (PSK)	Cryptographically random 32+ character secret

---

3. Implementation Path A: Fortinet FortiGate (FortiOS)

Configure on the Headquarters FortiGate via CLI:

Step 1: Configure Phase 1 (IKEv2 Proposal)

config vpn ipsec phase1-interface
    edit "VPN-TO-BRANCH01"
        set interface "wan1"
        set ike-version 2
        set keylife 86400
        set peertype any
        set net-device disable
        set proposal aes256gcm-prfsha384 aes256-sha384
        set dpd on-idle
        set dpd-retryinterval 10
        set dhgrp 19 21
        set remote-gw 203.0.113.1
        set psksecret "SuperSecretRandom32CharPreSharedKey!"
    next
end

Step 2: Configure Phase 2 (IPsec VTI Interface)

config vpn ipsec phase2-interface
    edit "VPN-TO-BRANCH01-P2"
        set phase1name "VPN-TO-BRANCH01"
        set proposal aes256gcm
        set dhgrp 19 21
        set keylifeseconds 28800
        set src-subnet 0.0.0.0 0.0.0.0
        set dst-subnet 0.0.0.0 0.0.0.0
    next
end

Step 3: Assign IP to Tunnel Interface & Create Static Route

config system interface
    edit "VPN-TO-BRANCH01"
        set ip 172.16.255.1 255.255.255.255
        set remote-ip 172.16.255.2 255.255.255.252
        set allowaccess ping
    next
end

config router static
    edit 102
        set dst 10.20.0.0 255.255.0.0
        set device "VPN-TO-BRANCH01"
    next
end

Step 4: Configure Bi-Directional Firewall Policies

config firewall policy
    edit 201
        set name "LAN-TO-BRANCH-IPSEC"
        set srcintf "vlan20-servers" "vlan30-users"
        set dstintf "VPN-TO-BRANCH01"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 202
        set name "BRANCH-TO-LAN-IPSEC"
        set srcintf "VPN-TO-BRANCH01"
        set dstintf "vlan20-servers"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
end

---

4. Implementation Path B: Cisco IOS-XE Router / Firewall

Configure on Cisco IOS-XE router at Headquarters:

Step 1: Configure IKEv2 Proposal & Keyring

configure terminal

crypto ikev2 proposal PROP-IKEV2-SECURE
 encryption aes-gcm-256
 prf sha384
 group 19
exit

crypto ikev2 policy POL-IKEV2-SECURE
 proposal PROP-IKEV2-SECURE
exit

crypto ikev2 keyring KEYRING-BRANCH01
 peer BRANCH01
  address 203.0.113.1
  pre-shared-key SuperSecretRandom32CharPreSharedKey!
 exit
exit

crypto ikev2 profile PROF-IKEV2-BRANCH01
 match identity remote address 203.0.113.1 255.255.255.255
 authentication remote pre-share
 authentication local pre-share
 keyring local KEYRING-BRANCH01
 dpd 10 3 on-demand
exit

Step 2: Configure IPsec Transform-Set & Profile

crypto ipsec transform-set TS-AES256-GCM esp-gcm 256
 mode transport
exit

crypto ipsec profile PROF-IPSEC-VTI
 set transform-set TS-AES256-GCM
 set ikev2-profile PROF-IKEV2-BRANCH01
 set pfs group19
exit

Step 3: Configure Virtual Tunnel Interface (VTI) & Routing

interface Tunnel100
 description VTI-TO-BRANCH01
 ip address 172.16.255.1 255.255.255.252
 tunnel source GigabitEthernet0/0/0
 tunnel mode ipsec ipv4
 tunnel destination 203.0.113.1
 tunnel protection ipsec profile PROF-IPSEC-VTI
 exit

ip route 10.20.0.0 255.255.0.0 Tunnel100
write memory

---

5. Implementation Path C: pfSense / OPNsense Firewall

Step 1: Configure Phase 1 (VPN → IPsec)

1. Navigate to: VPN → IPsec → Tunnels.
2. Click + Add P1:
   • Key Exchange version: IKEv2
   • Internet Protocol: IPv4
   • Interface: WAN
   • Remote Gateway: 198.51.100.1 (or 203.0.113.1)
   • Authentication Method: Pre-Shared Key
   • My identifier: My IP address | Peer identifier: Peer IP address
   • Encryption Algorithm: AES-GCM (256 bits)
   • PRF: SHA384 | Diffie-Hellman Group: 19 (256-bit ECP)
   • Life Time: 86400
   • Dead Peer Detection: Enable (Delay: 10, Retries: 3)

Step 2: Configure Phase 2 (Routed VTI)

1. Inside the created Phase 1, click + Add P2:
   • Mode: Routed (VTI)
   • Local Network: 172.16.255.2/30
   • Remote Network: 172.16.255.1/30
   • Protocol: ESP
   • Encryption: AES256-GCM
   • PFS Key Group: 19 (256-bit ECP)
   • Lifetime: 28800

Step 3: Assign Interface & Create Static Route

1. Go to Interfaces → Assignments, assign the new ipsec VTI interface.
2. In System → Routing → Gateways, verify the gateway 172.16.255.1.
3. In System → Routing → Static Routes, route 10.10.0.0/16 via this gateway.
4. Under Firewall → Rules → IPsec, create an allow rule for required traffic.

---

6. Operational Verification & Troubleshooting

On Fortinet FortiGate:

# Check Phase 1 IKEv2 SA
diagnose vpn ike gateway list name "VPN-TO-BRANCH01"

# Check Phase 2 IPsec Tunnel & Byte Counters
diagnose vpn tunnel list name "VPN-TO-BRANCH01-P2"

Expected: State reports up, with active inbound/outbound packets incrementing.

On Cisco IOS-XE:

# Verify IKEv2 Session
show crypto ikev2 sa

# Verify IPsec Encapsulation
show crypto session detail

On pfSense / OPNsense:

• Navigate to: Status → IPsec → Overview.
• Both Phase 1 and Phase 2 status badges must display Green (Connected).

Ping Validation across VTI:

ping 172.16.255.2 source 172.16.255.1

---

7. Rollback & Emergency Tunnel Flapping Isolation

If the VPN tunnel flaps erratically, causing router CPU spikes:

1. Administrative Tunnel Shutdown:
   • On FortiGate: config vpn ipsec phase1-interface → edit "VPN-TO-BRANCH01" → set status disable → end.
   • On Cisco: interface Tunnel100 → shutdown.
   • On pfSense: Checkbox Disable this phase 1 under VPN settings.
2. Verify system logs for PSK mismatches or proposal disagreements:
   • FortiOS: diagnose debug application ike -1
   • Cisco: debug crypto ikev2