Site-to-site VPN
A site-to-site VPN connects two or more networks over the internet, creating a permanent tunnel between them. The VPN endpoints — routers or firewalls at each site — negotiate the VPN, encrypt traffic, and decrypt it on the other end. End devices at each site have no awareness that a VPN is in use; they communicate as if directly connected.
Site-to-site VPNs replace or supplement dedicated WAN links (MPLS, leased lines). A company with headquarters and a branch office uses a site-to-site VPN so branch employees can access HQ resources securely over internet connectivity — which is cheaper than a dedicated private WAN link.
Configuration requires matching parameters at both ends: the same encryption algorithm, hashing algorithm, authentication method, and Diffie-Hellman group. Mismatched parameters are the most common reason VPN tunnels don't establish.
Remote access VPN
A remote access VPN connects individual users to the corporate network from anywhere — home, hotel, coffee shop. The user runs a VPN client (Cisco AnyConnect, OpenVPN) that creates a tunnel to the VPN concentrator at the corporate edge.
Remote access VPNs use either IPsec or SSL/TLS. SSL VPNs (like Cisco AnyConnect with SSL mode) work over HTTPS (TCP 443), which is rarely blocked by firewalls. IPsec remote access VPNs use IKE (UDP 500) and ESP (IP protocol 50), which some firewalls block.
Split tunneling controls whether all traffic from the client goes through the VPN or only corporate-destined traffic. With split tunneling enabled, a remote user's internet traffic goes directly to the internet while only traffic destined for corporate subnets traverses the VPN. This reduces VPN gateway load but removes corporate security policy inspection for internet traffic.
IPsec components: AH, ESP, and IKE
IPsec is a framework of protocols for securing IP communications. The two core protocols: AH (Authentication Header, IP protocol 51) provides data integrity and authentication but no encryption. ESP (Encapsulating Security Payload, IP protocol 50) provides data integrity, authentication, AND encryption. In practice, ESP is almost always used because AH doesn't encrypt — AH by itself offers no confidentiality.
IKE (Internet Key Exchange) negotiates the parameters and keys used by AH/ESP. IKE operates in two phases: Phase 1 establishes a secure management channel (ISAKMP SA) used to protect Phase 2 negotiations. Phase 2 negotiates the actual IPsec tunnel parameters (IPsec SA). IKEv2 (the modern version) is more efficient, more secure, and supports MOBIKE for mobile clients.
Transport mode vs Tunnel mode: Transport mode encrypts only the payload (used between hosts, typically for host-to-host encryption). Tunnel mode encapsulates the entire original IP packet (header + payload) and adds a new outer IP header — this is what site-to-site VPNs use. The original packet is hidden inside the tunnel.
GRE tunnels
GRE (Generic Routing Encapsulation, IP protocol 47) is not a VPN protocol — it doesn't encrypt. GRE creates logical point-to-point tunnels that can carry any Layer 3 protocol (IPv4, IPv6, OSPF multicast) between two routers. GRE tunnels allow routing protocols to run over the internet between sites that are separated by NAT or different network types.
GRE is often combined with IPsec: GRE provides the tunnel that allows routing protocol packets (which IPsec alone cannot carry) to flow between sites, and IPsec provides encryption. GRE over IPsec is the combination — IPsec encrypts the GRE-encapsulated packets.
For CCNA, understand that GRE by itself provides no security but solves the multicast/routing protocol problem. IPsec by itself doesn't support multicast. GRE + IPsec provides both tunneling flexibility and encryption.