Virtual Private Network (VPN)

Course at a glance

• 37 lessons in 10 units.
• Format: self-paced lessons with Cisco IOS configurations, packet captures, and video.
• Last updated: October 2026.

What is a VPN?

A VPN (Virtual Private Network) builds a tunnel over a network you don’t control, like the Internet. One end of the tunnel encrypts the original IP packet, adds a VPN header and a new IP header, and sends it to the other end, which checks the packet, decrypts it, and forwards the original packet. A secure VPN offers confidentiality (encryption), authentication, integrity, and anti-replay protection. On Cisco routers, IPsec is the framework that provides these features, with IKE to set up the tunnels and ESP to protect the data.

There are two common VPN types. A site-to-site VPN connects two networks through two network devices, so hosts don’t know there is a VPN. A client-to-site or remote access VPN runs between a VPN client on a laptop or phone and a router or firewall. Point-to-point tunnels don’t scale when you have many sites, so we also have technologies like DMVPN and FlexVPN that build hub and spoke networks with dynamic spoke-to-spoke tunnels. Not every VPN is encrypted, by the way: MPLS VPN separates customers without encryption.

Who uses VPNs? Almost every company. Branch offices connect to headquarters with site-to-site VPNs over regular Internet connections, often as an alternative or backup for MPLS VPN, and remote workers use remote access VPNs. DMVPN is a common choice on Cisco routers for connecting many branches.

VPN Learning Roadmap

This roadmap follows the course units. Each topic has a short explanation and links to the lessons where we cover it in detail.

VPN and IPsec Fundamentals

We start with what VPNs are and why we use them. IPsec is a framework, not a single protocol. IKE builds the tunnels in two phases: phase 1 builds a secure management tunnel, and phase 2 negotiates the IPsec SAs that protect user data. AH and ESP both offer authentication and integrity, but only ESP encrypts, so ESP is what we use nowadays. You’ll configure IPsec tunnel mode with a crypto map, encrypt a GRE tunnel, and use static and dynamic VTIs so you don’t need access-lists to select the traffic to encrypt.

DMVPN Basics and Phase 1

DMVPN (Dynamic Multipoint VPN) is a Cisco technology that builds hub and spoke VPNs without configuring a tunnel for every site. It uses multipoint GRE, so one tunnel interface reaches all sites, and NHRP to map tunnel addresses to public addresses. In phase 1, all traffic goes through the hub. We start with the phase 1 configuration and run EIGRP, OSPF, and BGP on top of it.

DMVPN Phase 2 and Phase 3

Phase 2 adds direct spoke-to-spoke tunnels, but spokes need specific routes with the original next hop, so the hub can’t summarize. That makes the routing protocol configuration important: you’ll see how EIGRP, OSPF network types, and BGP behave. Phase 3 fixes this with NHRP redirects and shortcuts. The hub can advertise a summary or default route, and when a spoke sends traffic for another spoke through the hub, the hub tells both spokes to build a direct tunnel. You’ll run EIGRP, OSPF, and BGP on a phase 3 network as well.

Advanced DMVPN

DMVPN doesn’t encrypt anything by itself, so on the Internet we add IPsec. A single hub is a single point of failure; with dual hub single cloud, spokes use a second hub on the same tunnel interface, and with dual hub dual cloud, every spoke gets a second DMVPN network. We also look at per-tunnel QoS, which applies a different QoS policy to groups of spokes, and at running IPv6 over an IPv4 DMVPN network.

FlexVPN and IKEv2

Cisco has many VPN types, each with its own configuration and show commands. FlexVPN is Cisco’s answer: one framework for site-to-site, hub and spoke, and remote access VPNs, all based on IKEv2. Smart defaults give you predefined values based on best practices, so there is less to configure, and you’ll also build a site-to-site VPN without smart defaults. You can authenticate with pre-shared keys or certificates (PKI), and advertise routes with a routing protocol or with IKEv2 routing, which exchanges them within IKEv2 itself.

FlexVPN Topologies and Remote Access

With FlexVPN hub and spoke, all traffic goes through the hub. Like DMVPN, FlexVPN uses NHRP for direct spoke-to-spoke tunnels, but only for resolution: spokes don’t register with the hub. You’ll also build spoke-to-spoke tunnels with an address pool and BGP. FlexVPN supports remote access for AnyConnect clients as well, and you can run MPLS over FlexVPN to extend VRFs securely over the Internet.

L2TPv3 and GETVPN

Two more VPN technologies with a specific job. L2TPv3 is a point-to-point tunnel that carries layer 2 protocols like Ethernet over IP, so you can put two remote sites in the same subnet. GETVPN is a tunnel-less VPN for private networks like MPLS VPN. A key server hands out one SA to all group members, and because GETVPN preserves the original IP header, the network can still route on the real addresses.

Ready to master VPNs?

Get access to all 37 VPN lessons and every other course on NetworkLessons.com.

Sign up