IntermediatePublished 2026-10-27
CCNP Site-to-Site VPN: Route Over a Protected Tunnel
Today's daily lab
Included with a subscription.
Subscribe to unlockBuild a routed VPN between HQ and the branch: a tunnel interface protected by IPsec on each router, with each LAN routed into it.
Learning objectives
- Bind a transform set to an IPsec profile
- Build a protected tunnel interface on each router
- Route the remote LAN into the tunnel
Troubleshooting focus
- Tunnel up but nothing passes: the other router is not protecting its tunnel yet
- Replies never arrive: a static route is missing on one side
Topology
Subscribe to see the full topology.
See plansGrade your work
How this lab is graded
- Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with
access-class, are stated in the guide and do have to match. - Addresses, modes and protocol keywords are exact. An IP address, a subnet mask,
switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide. - Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the
running-config— a change that only exists in a terminal session never reaches the grader. - You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
- Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.
Found a problem with this lab?
Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.