IPSec Profile

Updated: July 8, 2026

Want to summarize with AI?

Learn how an IPSec Profile defines secure connection settings for site-to-site VPN tunnels and protects data exchanged between network peers.

The use of Internet Protocol Security (IPSec) profiles for a virtual tunnel interface can simplify the configuration process when you need to provide protection for remote access. An IPSec profile contains the required security protocols and algorithms required to ensure a secure, logical communication path between two site-to-site VPN peers. t is a required component when creating a tunnel as the VPN depends on IPsec tunnels for network-to-network, host-to-network and host-to-host communications. The IPSec profile allows you to configure both IKE and IPSEC parameters in one place for additional security and encryption protection.

If you choose to include an IPSec profile within your site-to-site tunnel configuration, the profile provides robust network security by encrypting and authenticating data as it travels between points on the network as well as the flexibility of being compatible with site-to-site, client-to-site, and client-to-client tunnels.

Create an IPSec Profile

Use the following procedure to create an IPSec profile from the Multicloud Defense Controller dashboard:

Procedure

	1.	Navigate to Infrastructure > Network > IPSec.
	2.	Click Create.
	3.	Enter a unique Profile Name.
	4.	(Optional) Enter a Description. This may help differentiate from other profiles with a similar name.
	5.	Enter the appropriate IKE information when prompted: DH Group - Diffie-Hellman (DH) groups determine the strength of the key used in the key exchange process. Expand the drop-down menu to select the appropriate groups for the profile. Authentication - Expand the drop-down menu to select the types of authentication you want for this tunnel. Encryption - Intercepted stacks require encrypting and decrypting. Expand the drop-down menu to select your method of encryption. Hash - SHA1 is a one-way hashing algorithm that produces a 160-bit digest. Use the drop-down menu to select the appropriate option. Key Lifetime - Enter a time value in seconds for how long the key lasts. Avaialble values are between 60 sec and 86400 sec. IKE Version -The Internet Key Exchange (IKE) is a protocol that is used to set up a security association in the IPSec protocol suite that provides robust authentication and encryption of IP packets. Use the drop-down menu to select either IKE version 1 or version 2. There are significant differences between the versions so be sure to select the one most appropriate for your environment.
	6.	Enter the appropriate IPsec information when prompted: Authentication - Expand the drop-down menu to select an authentication method: None, SHA256, SHA, or Null. Encryption - Expand the drop-down and select a type of key: AES GCM 256, AES GCM 192, or AES GCM. This generates a unique key exchange between the connected devices, so that each device can decrypt the other device's messages. Mode - Expand the drop-down menu to select the IPSec policy authentication protocol. You can select more than one.

What to do next

Attach the profile to a policy rule set. See Rule Sets and Rule Set Groups for more information.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.