CCNA 200-301 v1.1 reference — Security Fundamentals
IPsec VPN fundamentals
Remote-access versus site-to-site VPNs, what IPsec protects, and where each design fits at CCNA concept depth.
Objective 5.5v1.1 exam target
Loading
A VPN carries private traffic over a shared network between two endpoints — typically by encapsulation plus encryption in the IPsec/TLS cases the exam covers (other VPN families like MPLS VPNs provide separation without necessarily encrypting). IPsec is the framework that provides confidentiality (encryption), integrity (hashing), authentication and key management (IKE).
Remote-access versus site-to-site
| Property | Remote-access VPN | Site-to-site VPN |
|---|---|---|
| Endpoints | User device ↔ VPN headend | Two gateways/routers |
| Who's protected | Individual users (teleworkers) | Entire LAN segments, transparently |
| Client needed | Yes (VPN client software) | No — hosts are unaware |
| Typical use | Working from anywhere | Branch ↔ HQ over the internet |
IPsec components (concept level)
| Component | Role |
|---|---|
| IKE (ISAKMP) | Negotiates security associations and keys — UDP 500 |
| ESP | Confidentiality + integrity for the payload (IP protocol 50) |
| AH | Integrity/authentication only (IP protocol 51) — rare in practice |
| Tunnel vs transport mode | Tunnel encrypts+encapsulates the whole packet (VPNs); transport protects payload only |
Pick the deployment for a scenario
- Scenario
- A branch office's 30 devices must reach HQ resources over broadband
- Installing/maintaining a client on all 30 devices is impractical — including printers and phones.
- A site-to-site IPsec tunnel between the branch router and HQ headend makes the whole LAN reachable transparently.
- Remote-access VPN would be right for the same office's five traveling users instead.
Site-to-site protects networks; remote-access protects people.
Related resources
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
- RFC 4301 — Security Architecture for the Internet Protocol — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.