ADVPN Network Security

Hi @JGaiser ,

Using specific subnets in Phase 2 selectors in an ADVPN setup can be scalable, but it requires careful planning and management. Here are some key points to consider for scalability:

Number of Tunnels: If you have a large number of spokes and each spoke has specific subnets that need to communicate with specific subnets on other spokes, you could end up with a large number of Phase 2 configurations. This can increase the complexity of the configuration and management of the VPN.
Dynamic Routing Protocol: Using a dynamic routing protocol like BGP helps manage the scalability by dynamically advertising and learning routes. This reduces the need for static routing configurations. However, ensure that your routing protocol is properly optimized to handle the scale of your network.
Resource Usage: More specific Phase 2 selectors can lead to more IPsec SAs, which can increase resource usage on your devices. Ensure that your devices have the necessary resources (CPU, memory, etc.) to handle the increased load.
Management Overhead: Managing a large number of specific Phase 2 selectors can be more challenging than using a broad 0.0.0.0/0 selector.
Security: Using specific Phase 2 selectors can enhance security by limiting which subnets can communicate over the VPN. This can be particularly important in larger networks where different segments may have different security requirements.

While using specific Phase 2 selectors in an ADVPN setup can be scalable, it requires careful planning, efficient use of dynamic routing protocols, and resource management to handle the complexity.

BR.

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.