Hello friends, welcome back—this is Day 41 of my PCNSA Palo Alto series. In this session I’m showing you how to configure an IKEv2 site-to-site IPsec VPN and, more importantly, how to validate what’s really happening using a Wireshark capture. I’m using the same lab topology we used for IKEv1, and I’ll clearly tell you what changes are required for IKEv2 (honestly, it’s just one or two key options). We go step-by-step: Phase 1 (IKE Crypto policy), Phase 2 (IPsec Crypto), IKE Gateway settings (peer IP, pre-shared key, local interface 1/2), and IKE version selection as v2. After the config, I commit on both firewalls and then I capture traffic on the outside interface to analyze the negotiation. In Wireshark, I show you how many messages are exchanged during tunnel formation and what is clear text vs encrypted. My key takeaway: IKEv2 completes negotiation faster—first two messages are clear text and after that it becomes encrypted, and the full tunnel establishment happens in fewer total messages compared to IKEv1. Finally, I verify the tunnel status in the Palo Alto UI (Network > IPsec), check IKEv2 mode, and confirm encaps/decaps counters while doing ping tests both ways between the subnets.