IPSec site-to-site, WireGuard and OpenVPN. Keys are emitted as placeholders — generate them on the device and keep them out of version control.
Both peers must match on every parameter or the tunnel never establishes.
! Cisco IOS / IOS-XE — IPSec branch-to-hq, generated by NetField
! Never commit the pre-shared key — replace it with a reference to a secret store.
! Both peers must agree on every phase 1 and phase 2 parameter or the tunnel will not establish.
configure terminal
!
crypto ikev2 proposal branch-to-hq-prop
encryption aes-256
integrity sha256
group 14
!
crypto ikev2 policy branch-to-hq-pol
proposal branch-to-hq-prop
!
crypto ikev2 keyring branch-to-hq-key
peer 198.51.100.1
address 198.51.100.1
pre-shared-key <PRESHARED_KEY>
!
crypto ipsec transform-set branch-to-hq-ts esp-aes-256 esp-sha256-hmac
mode tunnel
!
crypto map branch-to-hq-map 10 ipsec-isakmp
set peer 198.51.100.1
set transform-set branch-to-hq-ts
match address branch-to-hq-acl
!
ip access-list extended branch-to-hq-acl
permit ip 10.20.0.0 0.0.255.255 10.30.0.0 0.0.255.255
!
end