https://networkhaven.org/tags/design/ Recent content in Design on Network Haven Hugo en-US Thu, 24 Sep 2026 00:00:00 +0000 https://networkhaven.org/posts/ipsec-ikev2-hub-and-spoke-design/ Thu, 24 Sep 2026 00:00:00 +0000 https://networkhaven.org/posts/ipsec-ikev2-hub-and-spoke-design/ <p>This blog demonstrate a possible IPsec hub and spoke design with IKEv2 and VTI. The focus here is on an IPsec configuration that is identical on all sides to ensure a consistent configuration. The basic design is shown in the figure below. <img src="https://networkhaven.org/posts/ipsec-ikev2-hub-and-spoke-design/IPsec-Hub-Spoke.svg" alt="image"></p> <h2 id="security-considerations">Security considerations</h2> <p>In general, this example uses AES (CBC) with at least 256 bits. On newer Cisco routers, it is possible to use AES in GCM mode. GCM is the newer mode compared to CBC. However, there are potential security concerns with GCM if the initial vector is reused. One advantage of GCM is that it combines encryption and integrity, eliminating the need for an additional algorithm for integrity (as is the case with CBC).</p>