New Tool - IPsec VPN Configuration Generator (Multi-Vendor, Policy vs Route-Based Interop)

Added a new one to the Network Tools page: an IPsec VPN Configuration Generator for Cisco IOS/IOS-XE, ASA, FortiGate, Palo Alto, Juniper SRX, strongSwan/VyOS, UniFi, and pfSense/OPNsense.

The reason I built this instead of just pointing at vendor docs is the case that actually breaks real deployments: pairing a policy-based peer with a route-based one. A route-based side (VTI/tunnel interface) defaults to a catch-all 0.0.0.0/0 ↔ 0.0.0.0/0 selector, since routing decides what enters the tunnel. A policy-based peer negotiates specific proxy-IDs per subnet pair, pulled straight from its ACL. Put those two together unmodified and phase 2 negotiation just fails — no useful error, just a tunnel that won’t come up.

The tool computes the fix automatically: whichever side is route-based gets its proxy-ID/traffic-selector narrowed to exactly match the policy-based side’s subnet pairs, and it tells you when and why that kicked in. Pick “generate both sides” and you get two configs guaranteed to actually agree with each other, instead of hand-matching proposals between two different vendor CLIs.

A few other things it handles:

• IKEv1 and IKEv2, Main and Aggressive mode.
• Interesting traffic per subnet pair — restrict to a specific protocol/port (or leave it wide open), not just source/destination subnets.
• Juniper specifically always generates the modern route-based (st0 + traffic-selector) structure, even when you pick “policy-based” for that side — that’s Junos’s own recommended way to match a policy-based peer, not the legacy permit tunnel ipsec-vpn style.
• UniFi and pfSense/OPNsense render as GUI field values instead of fake config files, since that’s how those platforms actually get configured.
• An algorithm-naming cheat sheet, since half of debugging cross-vendor IPsec is realizing both sides picked AES-256/SHA-256/DH14 and are just spelling it differently (aes 256 vs aes-256-cbc vs aes256).

Same rules as every other tool on this site: runs entirely in your browser, nothing sent anywhere. It’s a starting point, not a guarantee — lab-test before touching production, same as always.

fryguy.net/tools-ipsec-generator