# FlexVPN to Cisco IOS-XE

> IKEv2 FlexVPN between VyOS and Cisco IOS-XE - modern IPsec setup, smart defaults, certificate auth, and virtual-template interfaces

Source: https://opennix.org/en/docs/vyos/examples/vpn-flexvpn/


FlexVPN is Cisco's modern VPN solution built on IKEv2 for both Site-to-Site and Remote Access scenarios.

## Scenario

- Modern Cisco Integration: VyOS ↔ Cisco IOS-XE
- IKEv2 only (no IKEv1 legacy)
- Certificate-based or PSK authentication

## VyOS Configuration

```bash
# IKE Group (IKEv2)
set vpn ipsec ike-group FLEXVPN key-exchange 'ikev2'
set vpn ipsec ike-group FLEXVPN proposal 1 encryption 'aes256gcm128'
set vpn ipsec ike-group FLEXVPN proposal 1 hash 'sha256'

# VTI
set interfaces vti vti10 address '172.16.255.1/30'

# Peer
set vpn ipsec site-to-site peer 203.0.113.10 vti bind 'vti10'
```

## Cisco IOS-XE Configuration

```cisco
crypto ikev2 proposal FLEX-PROP
 encryption aes-gcm-256
 prf sha256
 group 14

crypto ikev2 profile FLEX-PROF
 match identity remote address 198.51.100.1
 authentication local pre-share key SecureKey
 authentication remote pre-share key SecureKey

interface Tunnel10
 ip address 172.16.255.2 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 198.51.100.1
 tunnel protection ipsec profile FLEX-IPSEC
```

## References

- [Cisco FlexVPN Configuration Guide](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/xe-16/sec-flex-vpn-xe-16-book.html)
- [VyOS IKEv2](https://docs.vyos.io/en/latest/configuration/vpn/ipsec.html)