Ip nat inside source list NAT int g2 overload Note: I use TinyLinux endpoints to generate traffic of interest from LAN to LAN because the advanced ping command on Branch and HE did not work well and did not start the IKEv2 processing. On real devices, IKEv2 is supported on Cisco ISR Generation 2 (G2) that runs Cisco IOS software version 15.2(4)M or later (for example 29xx ISR), ASA with 8.4.(1) and later (including ASA 5510). I also do not use GRE tunnel for the interconnection of both sides, instead, simple static default routes are used.Ĭonfiguration runs on GNS3 emulator and I’m using the CSR1000v platform with version 16.12.01a IOS XE as the older ISR platform (7200 15.4 IOS) does not support IKEv2.

In this example, I’m using the symmetric PSK witch crypto map, where the IKEv2 process is started by ACL that identifies interesting traffic. There are several options for how to configure IKEv2. Topology simulates a Branch router connected over an ISP to the HQ router.

VPN will use IKEv2 protocol with PreSharedKey (PSK) remote-site authentication. This config example shows a Site-to-Site configuration of IPsec VPN established between two Cisco routers.

Cisco packet tracer vpn example