Configure a policy-based site-to-site VPN

Configure a policy-based site-to-site VPN to establish secure communication channels between network endpoints using crypto maps and specified network topologies.

Procedure

Step 1	Choose Secure Connections > Site-to-Site VPN & SD-WAN, click Add, and enter the topology name in the Topology Name field.
Step 2	Click the Policy-Based VPN radio button and select the VPN topology and click Create.
Step 3	Choose the IKE versions to use during IKE negotiations. Check the IKEv1 or IKEv2 check box. Default is IKEv2. Select either or both options as appropriate; select IKEv1 if any device in the topology doesn't support IKEv2. You can also configure a backup peer for point-to-point extranet VPNs. For more information, see Firewall Threat Defense VPN endpoint options.
Step 4	Add Endpoints for this VPN deployment by clicking Add () for each node in the topology. Configure each endpoint field as described in Firewall Threat Defense VPN endpoint options. For Point to point, configure Node A and Node B. For Hub and Spoke, configure a Hub Node and Spoke Nodes For Full Mesh, configure multiple Nodes
Step 5	(Optional) Specify non-default IKE options for this deployment as described in Firewall Threat Defense VPN IKE options
Step 6	(Optional) Specify non-default IPsec options for this deployment as described in Firewall Threat Defense VPN IPsec options
Step 7	(Optional) Specify non-default Advanced options for this deployment as described in Firewall Threat Defense advanced site-to-site VPN deployment options and click Save.

The policy-based site-to-site VPN is configured with the specified endpoints, IKE settings, and topology options.

What to do next

Deploy configuration changes.

Note	Some VPN settings are validated only during deployment. Be sure to verify that your deployment was successful. If you get an alert that your VPN tunnel is inactive even when the VPN session is up, follow the VPN troubleshooting instructions to verify and ensure that your VPN is active.