What Is a Site-to-Site VPN? How It Works, Types, Benefits and IPsec Explained
Understanding VPNs is one part of maintaining a secure digital environment. For more practical security advice, read our guide: What Is Cyber Hygiene? 10 Best Practices to Stay Safe Online in 2026.
What Is a Site-to-Site VPN? How It Works, Types, Benefits and IPsec Explained
Modern businesses often operate from multiple locations. A company may have its head office in Kolkata, a branch office in Delhi, a data centre in Mumbai, and employees working remotely.
These locations need to communicate securely and exchange business data. Connecting every office through a private physical network can be expensive and difficult to manage.
This is where a Site-to-Site VPN (Virtual Private Network) becomes useful.
A site-to-site VPN creates an encrypted connection between two or more networks over an existing IP network, such as the public internet. It allows devices at different locations to communicate securely as if they were connected through a private network.
In this guide, you will learn what a site-to-site VPN is, how it works, the role of IPsec and IKE, its types, benefits, limitations, and common troubleshooting points.
1. What Is a Site-to-Site VPN?
A Site-to-Site VPN is a network security solution that connects two geographically separated networks through an encrypted VPN tunnel.
For example, consider a company with:
Head Office LAN:
192.168.10.0/24Branch Office LAN:
192.168.20.0/24Head Office VPN Gateway: Firewall A
Branch Office VPN Gateway: Firewall B
The VPN gateways establish a secure tunnel over the internet. Once the tunnel and routing are configured correctly, authorised devices in the head office can communicate with authorised devices in the branch office.
The VPN tunnel protects data while it travels across the untrusted network.
Important: A site-to-site VPN does not automatically make every device or application secure. Security also depends on firewall policies, routing, endpoint protection, authentication, and correct network configuration.
2. How Does a Site-to-Site VPN Work?
A site-to-site VPN generally uses two VPN gateways, such as firewalls or routers, to establish a secure connection.
Here is a simplified example:
Head Office
LAN:
192.168.10.0/24VPN Gateway: Firewall A
Public IP:
203.0.113.10
Internet
Carries encrypted VPN traffic between the gateways.
Branch Office
LAN:
192.168.20.0/24VPN Gateway: Firewall B
Public IP:
198.51.100.20
The connection works in the following sequence:
A device at the head office sends traffic to a device in the branch office.
The head office router or firewall checks its routing table and VPN policies.
The VPN gateway identifies the traffic that should use the tunnel.
The two gateways negotiate security parameters and authenticate each other.
An IPsec security association is established.
The original network packet is protected and encapsulated.
The encrypted packet travels across the internet to the remote VPN gateway.
The receiving gateway verifies and decrypts the packet.
The original packet is forwarded to the destination network, provided routing and firewall policies permit it.
The return traffic follows the corresponding reverse path.
Simple Site-to-Site VPN Network Diagram
HEAD OFFICE BRANCH OFFICE
PC / Server Network PC / Server Network
192.168.10.0/24 192.168.20.0/24
| |
| |
Firewall A ======================= Firewall B
Public IP: Public IP:
203.0.113.10 198.51.100.20
| |
+------------ INTERNET --------------+
Encrypted IPsec TunnelNote: The public IP addresses above are documentation-only example addresses. They are not real VPN endpoints.
3. What Is an IPsec VPN Tunnel?
IPsec stands for Internet Protocol Security. It is a group of protocols used to protect IP traffic through authentication, integrity checking, and encryption.
IPsec is widely used for site-to-site VPN connections because it can secure communication between network gateways from different vendors.
For example, a Cisco router can establish an IPsec VPN with a FortiGate firewall when both devices support compatible security settings.
An IPsec VPN commonly uses two important components:
IKE — Internet Key Exchange
IKE is responsible for negotiating security parameters and establishing the keys and security associations used by IPsec.
IKEv2 is commonly preferred for modern deployments because it improves the negotiation process and provides a more streamlined protocol than IKEv1.
IPsec — Data Protection
After the negotiation process, IPsec protects the actual network traffic.
It commonly uses:
Encryption to protect confidentiality.
Integrity checking to detect packet modification.
Authentication to verify the source and integrity of protected traffic.
Security associations to define how traffic is protected.
Common IPsec Components
| Component | Purpose |
|---|---|
| IKEv2 | Negotiates VPN security parameters |
| ESP | Protects IP traffic with encryption and integrity |
| Pre-shared key | A shared secret used for peer authentication |
| Certificates | Provide certificate-based authentication |
| Security Association (SA) | Defines the security parameters for protected traffic |
| PFS | Provides fresh key material for IPsec key exchanges |
4. What Are Phase 1 and Phase 2 in an IPsec VPN?
In a traditional IKEv2/IPsec configuration, administrators commonly refer to two stages as Phase 1 and Phase 2.
Phase 1 — Establishing the Secure Negotiation Channel
Phase 1 establishes an authenticated IKE security association between the VPN gateways.
The devices negotiate parameters such as:
Encryption algorithm
Integrity algorithm
Diffie-Hellman group
Authentication method
IKE lifetime
For example, an organisation may configure AES-256 encryption, SHA-256 integrity, and a suitable Diffie-Hellman group supported by both devices.
Phase 2 — Protecting the Actual Network Traffic
Phase 2 establishes the IPsec security associations used to protect data between the local and remote networks.
The gateways agree on parameters such as:
IPsec encryption and integrity algorithms
Local and remote traffic selectors
Perfect Forward Secrecy settings, if enabled
IPsec lifetime
Example:
Local network:
192.168.10.0/24Remote network:
192.168.20.0/24
These networks must be correctly defined in the VPN configuration and supported by the routing and firewall policies.
Note: With IKEv2, the protocol exchanges are not identical to the older IKEv1 Phase 1 and Phase 2 process. These terms are widely used in network administration to describe the IKE and IPsec setup stages.
5. Types of Site-to-Site VPN
There are two common deployment models.
A. Intranet-Based Site-to-Site VPN
An intranet-based VPN connects different locations belonging to the same organisation.
Example:
Head office
Regional office
Branch office
Data centre
All these locations can exchange authorised internal business traffic through VPN tunnels.
B. Extranet-Based Site-to-Site VPN
An extranet-based VPN connects an organisation's network with an external organisation, such as a business partner, supplier, or service provider.
For example, a company may establish a secure VPN connection with a third-party logistics provider to exchange authorised business information.
In this model, strict access control is especially important. Only the required networks, applications, and services should be permitted.
6. Site-to-Site VPN vs Remote Access VPN
These two VPN technologies serve different purposes.
| Feature | Site-to-Site VPN | Remote Access VPN |
|---|---|---|
| Connection | Network to network | Individual user to network |
| Typical users | Branch offices and data centres | Employees and contractors |
| VPN endpoint | Router or firewall | VPN gateway and user device |
| Client software | Usually not required on every endpoint | Often required |
| Common use | Branch connectivity | Work-from-home access |
| Example | Head office to branch office | Employee laptop to corporate network |
A site-to-site VPN is generally suitable when entire networks need secure connectivity. A remote access VPN is more suitable when individual users need access to corporate resources.
7. What Is the Difference Between Route-Based and Policy-Based VPN?
Network administrators may encounter two common IPsec VPN configuration approaches.
Route-Based VPN
A route-based VPN uses a logical or virtual tunnel interface. Routing determines which traffic should use that interface.
Common characteristics:
Uses a tunnel interface.
Supports routing-table-based traffic forwarding.
Can integrate with dynamic routing protocols, depending on the platform.
Often provides flexibility for larger or more complex network designs.
FortiGate commonly uses route-based VPN configurations with phase1-interface and phase2-interface.
Policy-Based VPN
A policy-based VPN uses security policies or crypto access-control rules to identify traffic that should be protected by the VPN.
Common characteristics:
Traffic selectors or ACLs identify protected traffic.
The VPN policy determines which traffic is encrypted.
The configuration model varies by vendor.
Cisco platforms commonly use crypto maps for certain policy-based IPsec deployments.
The best approach depends on the vendor, software version, topology, routing requirements, and interoperability needs.
8. What Are the Main Benefits of a Site-to-Site VPN?
Businesses use site-to-site VPNs for several reasons.
1. Secure communication
Encryption helps protect data as it travels over public networks.
2. Lower connectivity costs
Organisations can use existing internet connections rather than relying entirely on expensive private WAN circuits.
3. Multi-location connectivity
Multiple offices can communicate with central applications, servers, and other authorised resources.
4. Vendor interoperability
Standards-based IPsec VPNs can connect compatible devices from different vendors.
5. Centralised security management
VPN gateways can enforce access policies, logging, and security controls.
6. Scalability
Organisations can add VPN connections as new offices and locations are established, although the design and operational complexity increase with scale.
9. Common Site-to-Site VPN Problems and Troubleshooting
A VPN may show as connected but still fail to pass traffic. Troubleshooting should cover the entire path, not just the tunnel status.
| Problem | Possible cause | What to check |
|---|---|---|
| Phase 1 failure | Authentication or IKE mismatch | Peer IP, PSK, IKE version, proposals |
| Phase 2 failure | IPsec proposal or selector mismatch | Encryption, integrity, PFS, traffic selectors |
| Tunnel is up but no traffic | Routing or firewall policy issue | Routes, policies, selectors |
| One-way communication | Asymmetric routing or return-path issue | Routes in both directions |
| Tunnel drops frequently | Unstable WAN or lifetime mismatch | ISP connectivity, logs, timers |
| VPN fails behind NAT | NAT traversal issue | UDP 500/4500 and NAT-T |
| Some applications fail | MTU or fragmentation issue | Packet size, MSS, fragmentation |
Useful Troubleshooting Checks
Cisco IOS / IOS XE examples:
show crypto ikev2 sa
show crypto ipsec sa
show crypto session
show ip route
show access-listsFortiGate examples:
get vpn ipsec tunnel summary
diagnose vpn ike gateway list
diagnose vpn tunnel list
get router info routing-table allCommand availability and output can vary by device model and software version. Use the relevant vendor documentation for your platform.
Important Troubleshooting Tip
If the IPsec tunnel is established but users cannot access the remote LAN, check these items in order:
Confirm that both local and remote networks are correct.
Verify that the required routes exist.
Check firewall policies in both directions.
Confirm that NAT is not unintentionally changing protected VPN traffic.
Check the return route from the remote network.
Review IPsec counters and device logs.
This approach helps distinguish tunnel negotiation problems from routing and firewall problems.
10. Site-to-Site VPN Security Best Practices
A VPN tunnel should be configured with security and operational reliability in mind.
Prefer IKEv2 for new deployments where supported.
Use strong, modern encryption and integrity algorithms supported by both peers.
Avoid outdated algorithms such as DES, 3DES, and MD5.
Use strong, unique pre-shared keys or certificate-based authentication.
Enable Perfect Forward Secrecy where appropriate and supported.
Restrict VPN traffic to only the required networks and services.
Keep firewall and VPN gateway firmware updated.
Monitor tunnel availability, logs, and security events.
Document peer addresses, protected networks, and configuration changes.
Test failover and recovery procedures.
Never expose real pre-shared keys, public credentials, or sensitive network details in documentation.
A site-to-site VPN is only one part of a secure network design. It should be combined with proper firewall policies, endpoint security, monitoring, access control, and vulnerability management.
Frequently Asked Questions (FAQs)
1. What is the main purpose of a site-to-site VPN?
Its main purpose is to securely connect two or more separate networks over an IP network, allowing authorised devices at different locations to communicate.
2. Does a site-to-site VPN use IPsec?
IPsec is one of the most widely used technologies for site-to-site VPNs. Other VPN technologies and architectures also exist.
3. Is a site-to-site VPN encrypted?
An IPsec site-to-site VPN can encrypt traffic between VPN gateways. The actual protection depends on the configured algorithms and security policies.
4. What ports does an IPsec VPN use?
IKE commonly uses UDP port 500. When NAT Traversal (NAT-T) is used, IPsec traffic is commonly encapsulated in UDP port 4500. ESP is IP protocol number 50 when used without UDP encapsulation.
5. Can Cisco and FortiGate establish a site-to-site VPN?
Yes. Compatible Cisco routers and FortiGate firewalls can establish an IPsec VPN when both devices use compatible IKE, IPsec, authentication, routing, and traffic-selector settings.
6. What happens if a site-to-site VPN tunnel goes down?
Traffic that depends on the tunnel may stop reaching the remote network. Depending on the routing and failover design, traffic may be rerouted through another connection or remain unavailable until the VPN is restored.
7. Is a site-to-site VPN better than a leased line?
They solve related but different connectivity requirements. A VPN can be cost-effective over the internet, while a leased line or private WAN service may provide different performance, availability, and service-level characteristics.
Practical Lab: Configure a Cisco-to-FortiGate IPsec VPN
Understanding the concepts is important, but practical configuration is where network engineers develop troubleshooting skills.
If you want to configure a real lab, explore our step-by-step tutorial:
How to Configure a Site-to-Site IPsec VPN Between Cisco Router and FortiGate Firewall
It covers the configuration workflow, verification commands, and troubleshooting considerations for connecting Cisco and FortiGate devices.
Conclusion
A Site-to-Site VPN is an important technology for connecting geographically separated networks securely. By using IPsec and IKE, organisations can protect communication between branch offices, headquarters, and data centres over existing IP networks.
For network engineers, understanding IKE negotiation, IPsec security associations, routing, traffic selectors, firewall policies, and VPN troubleshooting is essential when supporting enterprise infrastructure.
Keep practising with lab environments and always validate configurations against the exact software versions and security requirements of your devices.
Cyber Hygiene Sec — Practical Networking, Cybersecurity and Network Engineering Knowledge.
Join the conversation