Cisco recommends that you have knowledge of the packet exchange for IKEv2. Could you please clarify, as I'm waiting for this feature being available for some months now. New here? The address range specifies that all traffic to and from that range is tunneled. Find answers to your questions by entering keywords or phrases in the Search bar above. For a branch office VPN that uses IKEv1, the Phase 1 exchange can use Main Mode or Aggressive Mode. Following is the output of above router debug crypto ikev2: 189014: *Aug 8 14:01:22.145 Chicago: IKEv2:Received Packet [From 2.2.2.2:500/To 1.1.1.1:500/VRF i0:f0], Initiator SPI : 8A15E970577C6140 - Responder SPI : 0000000000000000 Message id: 0, SA KE N NOTIFY(REDIRECT_SUPPORTED) NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP) NOTIFY(Unknown - 16430), 189015: *Aug 8 14:01:22.145 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Verify SA init message, 189016: *Aug 8 14:01:22.145 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Insert SA, 189017: *Aug 8 14:01:22.145 Chicago: IKEv2:Searching Policy with fvrf 0, local address 1.1.1.1, 189018: *Aug 8 14:01:22.145 Chicago: IKEv2:Found Policy 'ikev2policy', 189019: *Aug 8 14:01:22.145 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Processing IKE_SA_INIT message, 189020: *Aug 8 14:01:22.145 Chicago: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Retrieve configured trustpoint(s), 189021: *Aug 8 14:01:22.145 Chicago: IKEv2:(SA ID = 1):[PKI -> IKEv2] Retrieved trustpoint(s): 'TP-self-signed-653483565', 189022: *Aug 8 14:01:22.145 Chicago: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Get Public Key Hashes of trustpoints, 189023: *Aug 8 14:01:22.145 Chicago: IKEv2:(SA ID = 1):[PKI -> IKEv2] Getting of Public Key Hashes of trustpoints FAILED, 189024: *Aug 8 14:01:22.145 Chicago: IKEv2:Failed to retrieve Certificate Issuer list, 189025: *Aug 8 14:01:22.145 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):[IKEv2 -> Crypto Engine] Computing DH public key, DH Group 14, 189026: *Aug 8 14:01:22.145 Chicago: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] DH key Computation PASSED, 189027: *Aug 8 14:01:22.145 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Request queued for computation of DH key, 189028: *Aug 8 14:01:22.149 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):[IKEv2 -> Crypto Engine] Computing DH secret key, DH Group 14, 189029: *Aug 8 14:01:22.149 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Request queued for computation of DH secret, 189030: *Aug 8 14:01:22.161 Chicago: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] DH key Computation PASSED, 189031: *Aug 8 14:01:22.161 Chicago: IKEv2:(SA ID = 1):[IKEv2 -> Crypto Engine] Calculate SKEYSEED and create rekeyed IKEv2 SA, 189032: *Aug 8 14:01:22.161 Chicago: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] SKEYSEED calculation and creation of rekeyed IKEv2 SA PASSED, 189033: *Aug 8 14:01:22.161 Chicago: IKEv2:IKEv2 responder - no config data to send in IKE_SA_INIT exch, 189034: *Aug 8 14:01:22.161 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Generating IKE_SA_INIT message.