Cisco router VPNs are capable of tunneling from an intermediate device, the first router, to another intermediate device, the second router. By doing so, the data on the internal network is passed in the clear until it gets to the first intermediate device.

At that time, it is encrypted and forwarded on to the second router where it is decrypted and placed on the internal network of the second site in the clear.