IntermediatePublished 2026-10-25
CCNP Site-to-Site VPN: Encrypt the Branch Link
Free preview — the first lab of CCNP Site-to-Site VPN: IPsec, IKEv2 & DMVPN
Free account, no card.
Create account & downloadThe branch router is ready for an IPsec tunnel to HQ. Build the matching crypto map on the HQ router so the two LANs reach each other across the internet.
Learning objectives
- Match the branch's IKE phase 1 policy and pre-shared key
- Define the traffic to protect and the IPsec transforms
- Apply the crypto map to the internet-facing interface
Troubleshooting focus
- No ISAKMP SA: the phase 1 policy or the key does not match the peer
- SA up but no packets decrypted: the crypto ACLs are not mirror images
Topology
Grade your work
How this lab is graded
- Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with
access-class, are stated in the guide and do have to match. - Addresses, modes and protocol keywords are exact. An IP address, a subnet mask,
switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide. - Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the
running-config— a change that only exists in a terminal session never reaches the grader. - You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
- Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.
Create a free account to submit your lab for grading.
Create a free accountFound a problem with this lab?
Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.