Lab 2 — Harden a Site-to-Site VPN

Learner prompt: Connect HQ (10.10.0.0/16) to Branch‑A (10.20.0.0/16) and Branch‑B (10.30.0.0/16) over the Internet using the strongest broadly compatible settings.

Phase 1 (IKE) / Policy Settings

IKE Version

Encryption (ESP/IKE)

Integrity / PRF

DH / ECDH Group

Enable Perfect Forward Secrecy (PFS)

Authentication

Pre-shared key (PSK) Certificates (recommended)

Tunnel Type

Interesting Traffic (Subnet Pairs)

Add HQ (10.10.0.0/16) to each branch subnet.

Local (HQ)

Remote (Branch)