Configuring the IPSec site-to-site VPN
Before you can set up a VPN tunnel between two peers, you first need to agree on the cryptography settings that will need to be applied on both sides so that the tunnel can be negotiated. If the remote end is not under your control, you will need to reach out to your peer to agree on which configuration to use.
In the first phase (phase 1) of the negotiation, both peers authenticate one another through the Internet Key Exchange (IKE) process.
Once the authentication has been established, an IPSec Security Association (SA) is created on both sides that contains all the parameters needed to set up the phase 2 IPSec VPN tunnel.
The phase 1 crypto profile can be created in Network | Network Profiles | IKE Crypto. As you can see in the following screenshot, there are three default profiles already present with the following settings:
Figure 11.2: IKE crypto profiles
The default profile represents the most common cryptographic...
