Blocks inside blocks make one tunnel
A Cisco IKEv2 VPN is built from small configuration blocks that plug into each other by name. The tunnel uses an IPsec profile; the IPsec profile uses a transform set and an IKEv2 profile; the IKEv2 profile uses a keyring. Nested shows that composition for R1 and R3 side by side. Compare rows lines up each kind of block across the two routers.
- =Must match on both routers: algorithms, key, transform set.
- ⇄Must mirror: my address is your peer address.
- localLocal only: names are labels inside one router. They don't have to match the peer.
On every block, collapses or expands its fields and shows the IOS it becomes. Collapse a block and keep 👁 on to read it as configuration only.
Design sheet the parameters to implement
5 Verify in the simulator
The test loads both configurations into the simulated routers, lets R1 start the negotiation and pings through the tunnel. The simulator's negotiation was checked against captures from real IOS XE 26.02 routers.