Site-to-site links join networks; remote-access joins people — the laptop at the airport, the phone on hotel Wi-Fi, back into the office securely. This builds a modern IKEv2 remote-access VPN on IOS with an address pool, split tunnelling, and per-user auth — the road-warrior counterpart to the site-to-site post.
Remote-access VPN is a different shape from site-to-site: instead of two fixed peers, a client connects from anywhere, authenticates as a user, and is handed an address from a pool as if it plugged into the office LAN. On modern IOS the clean way to do this is IKEv2 (FlexVPN) remote access — the same IKEv2 you already know, plus an authorization policy that pushes config (the client's inside address, DNS, and split-tunnel routes) down to the client during the handshake.
Two auth models matter: EAP / username-password for the native OS clients and the Cisco Secure Client (formerly AnyConnect over IKEv2), and certificate-based for managed fleets. We'll build password-based with a local user store (swap in RADIUS/TACACS+ for scale), a dedicated client pool, and split tunnelling so only office-bound traffic enters the tunnel. Its RouterOS twin — IKEv2 and SSTP road-warrior — is here.
01
Define who can connect (AAA), what address they get (pool), and what config to push them (authorization policy — the piece that makes remote-access different from site-to-site).
R1(config)# aaa new-model R1(config)# aaa authentication login VPN-AUTH local R1(config)# aaa authorization network VPN-AUTHZ local R1(config)# username road.warrior secret 9 <scrypt-hash> # Address pool clients are assigned from (own subnet, routed to the LAN): R1(config)# ip local pool RA-POOL 10.99.0.10 10.99.0.200 # What we PUSH to the client: inside pool, DNS, and split-tunnel routes. R1(config)# crypto ikev2 authorization policy RA-AUTHZ R1(config-ikev2-author-policy)# pool RA-POOL R1(config-ikev2-author-policy)# dns 10.10.0.53 R1(config-ikev2-author-policy)# route set access-list SPLIT-TUNNEL
02
The profile ties it together: the router authenticates with a certificate (so clients trust it), clients authenticate with EAP (username/password), and the authorization policy is applied on success.
R1(config)# crypto ikev2 profile RA-PROF R1(config-ikev2-profile)# match identity remote any # clients from anywhere R1(config-ikev2-profile)# authentication local rsa-sig # router presents a cert R1(config-ikev2-profile)# authentication remote eap query-identity # client uses EAP R1(config-ikev2-profile)# pki trustpoint RA-TP R1(config-ikev2-profile)# aaa authentication eap VPN-AUTH R1(config-ikev2-profile)# aaa authorization group eap list VPN-AUTHZ RA-AUTHZ R1(config-ikev2-profile)# virtual-template 1 # spawns per-client interface
Remote-access flips the certificate direction from site-to-site: here the router must present a certificate the client will accept, or the connection fails at authentication with an unhelpful error. A self-signed cert means every client shows a scary warning (or refuses); use a cert from a CA the clients already trust, and make sure its subject/SAN matches the hostname clients dial. This is the single most common "it won't connect and the log is cryptic" cause for road-warrior IKEv2 — the crypto is fine, the trust isn't.
03
A virtual-template is the blueprint IOS clones into a per-client virtual-access interface. Split tunnelling — pushing only office routes — keeps the client's Netflix off your VPN and your uplink.
R1(config)# interface Virtual-Template1 type tunnel R1(config-if)# ip unnumbered GigabitEthernet0/1 # borrow the LAN IP R1(config-if)# tunnel mode ipsec ipv4 R1(config-if)# tunnel protection ipsec profile RA-IPSEC # Split tunnel: only these networks go through the VPN; the rest of the # client's traffic uses its own internet directly. R1(config)# ip access-list standard SPLIT-TUNNEL R1(config-std-nacl)# permit 10.10.0.0 0.0.255.255 # Omit the ACL entirely for a FULL tunnel (all client traffic via office).
04
IKEv2 works with native OS clients and the Cisco Secure Client. If you need to punch through hostile firewalls that block IKE, SSL VPN (TLS/443) is the fallback — same idea, different transport. Then confirm sessions.
R1# show crypto ikev2 sa # one SA per connected client, READY R1# show crypto session detail # assigned inside IP, uptime, pkts R1# show ip interface brief | inc Virtual-Access # per-client ifaces # SSL/TLS VPN (Secure Client over 443) is the fallback where UDP 500/4500 # is blocked on guest/hotel networks — worth having as an alternate profile.
Takeaways
NOCTIS builds remote-access VPNs on Cisco and MikroTik across Crete — IKEv2 and SSL road-warrior access with proper certificates, per-user auth, and split tunnelling that doesn't drag every laptop's traffic through your uplink.
Book a Discovery Call →