</>Code Temper

Beginner to intermediate · Free · In your browser

Learn VPN & IPsec Foundations

Learn what a site-to-site VPN does, then build one: the IKE and IPsec negotiations, proposals that match, pre-shared keys and identities, traffic selectors, NAT traversal, lifetimes, perfect forward secrecy and dead peer detection. Troubleshoot a tunnel from the stage where it stops, and review an old one. Lessons show the same settings on FortiGate, Huawei USG and Cisco IOS. Two projects end in a complete, resilient tunnel. The negotiation is modelled in memory; nothing is encrypted and no gateway is contacted.

20 lessons6 modules4.2 hours of practice4 challenges
Start the VPN & IPsec Foundations course →

No installation. Your code runs right in the browser. Networking Foundations or the same knowledge: IP addresses, subnets, ports and NAT. Firewall Foundations is a useful companion. The configuration format is a Code Temper teaching format, not the syntax of a product; the lessons show FortiGate, Huawei USG and Cisco IOS equivalents, which you should confirm against the documentation of your version. The lab models IKEv2 with pre-shared keys; certificates, remote-access VPNs and routing over tunnels are outside this course.

What you will be able to do

Course outline

Module 1

A private path over a public network

Gateways, the two negotiations, matching proposals, and traffic selectors.

  1. What a VPN tunnel doesGateways, peers & protected traffic · 10 min
  2. Two negotiations: IKE and IPsecThe IKE SA & the child SA · 11 min
  3. Both sides must offer the same thingProposals & NO_PROPOSAL_CHOSEN · 11 min
  4. Selectors choose what is encryptedTraffic selectors · 11 min
Module 2

Who is on the other end

Pre-shared keys, identities, and proposals worth offering.

  1. A shared key is a password for gatewaysPre-shared keys · 11 min
  2. Tell the peer who you areIKE identities · 11 min
  3. Stop offering weak algorithmsCipher suites & what the peer still accepts · 12 min
Module 3

Real networks

NAT traversal, several networks, narrowing, and a complete branch tunnel.

  1. A gateway behind NATNAT traversal · 11 min
  2. More than one networkMultiple selectors · 11 min
  3. What you asked for and what you gotNarrowing & split tunnelling · 12 min
  4. Project: connect a branch officeProject · peer, identity, proposals & selectors · 20 min
Module 4

Keeping the tunnel up

Lifetimes and rekeying, perfect forward secrecy, and dead peer detection.

  1. Lifetimes and rekeyingSA lifetimes · 11 min
  2. Perfect forward secrecyPFS & failures at rekey · 12 min
  3. Notice a dead peerDead peer detection · 11 min
Module 5

Troubleshooting

Read the negotiation by stage, debug the data path, and find an identity failure.

  1. Read the negotiation from the topStages & error codes · 13 min
  2. Tunnel up, no trafficSelectors & the data path · 12 min
  3. After the address changedIdentity failures · 11 min
Module 6

Put it together

Handle a change request, review an old tunnel, and build one you can hand over.

  1. Add a network to a working tunnelChange requests · 11 min
  2. Review an old tunnelVPN review · 14 min
  3. Project: a tunnel you can hand overCapstone · identity, NAT, proposals, selectors & resilience · 24 min

Ready for your first line?

Every lesson is short, hands-on, and checked automatically.

Start learning VPN & IPsec Foundations →