What is GETVPN?

Understanding GETVPN

GETVPN (Group Encrypted Transport VPN) is a Cisco technology that secures traffic among many sites without point-to-point tunnels. Instead of building an IPsec tunnel between every pair of routers, all members share group keys from a central Key Server, encrypting data while preserving the original IP packet headers for any-to-any, scalable connectivity.

It works using GDOI (Group Domain of Interpretation, RFC 6407). One or more Key Servers (KS) define the encryption policy and generate group keys; Group Members (GM) register with the KS, authenticate, and download the IPsec security associations and keys. The KS periodically rekeys members before keys expire — via unicast or multicast — so traffic is never interrupted. Because GETVPN uses tunnel mode with header preservation, the original source and destination IPs remain visible, letting the underlying network route and replicate multicast natively.

It matters because traditional hub-and-spoke or full-mesh IPsec scales poorly: N sites can require N-squared tunnels, breaking multicast and optimal routing. GETVPN solves this for trusted private transports like MPLS WANs, where the provider already routes the address space but the enterprise needs confidentiality and integrity. The trade-off is a centralized trust model — the Key Server is a critical asset, so deployments use redundant cooperative Key Servers and strong KS-to-GM authentication to avoid a single point of compromise or failure.

For example, a retailer with 300 branch routers over an MPLS WAN can enable GETVPN so every store encrypts traffic to every other store and to data centers using one shared policy, with no tunnel mesh to manage. Multicast video distribution still works because headers are preserved, and adding a new store only requires it to register with the Key Server rather than reconfiguring hundreds of peers.