In a cryptographic implementation, the gateways authenticate each other and protect selected traffic between sites. Hosts behind the gateways can often communicate without running individual VPN client software.
IPsec tunnel mode is a common implementation. Each gateway encapsulates an original packet inside a protected IP packet for transit and restores it at the far end. Static routes, dynamic routing, or policy-based traffic selectors determine which destinations use the tunnel. Multi-site designs may use hub-and-spoke, partial-mesh, or full-mesh topologies.
Key points
Peer and key managementAuthenticate gateways with appropriately managed credentials, use current cryptographic settings, automate renewal where safe, and maintain tested revocation procedures.
Routing and policyPrevent overlapping or unintended prefixes, validate route exchange, restrict permitted inter-site services, and preserve segmentation after decryption.
AvailabilityPlan redundant gateways and underlays, monitor tunnel and application health, test failover, and account for maximum transmission unit and fragmentation behavior.
Important limitationA cryptographic site-to-site VPN authenticates and protects the gateway relationship, not every host behind it. A compromised endpoint or excessive route can use the tunnel to reach the other site, and encryption does not prevent malicious traffic from an authorized network.