Policy Based or Route Based IPSec VPN?

Forum|Forum|16 years ago
September 29, 2009
6 replies
6859 views

I have 6 sites, I' ll end up with partially meshed topology, should I design my VPN using policy based or route based? I currently have two sites on policy based and have come across issues with dual WAN setup on my 110C. I' m asking the above question looking for next steps before I continue to troubleshoot my routing issues with dual WAN. With route based, I can have partially redundant tunnels... it' s nice to have, but not something I need. Also, to add a bit of background, while reading about route based, the configuration is what I originally expected. For example, I expected to configure routes manually for each VPN tunnel rather then using inbound NAT on policy based. Anyways, if it doesn' t matter, so be it, I' ll pick one and run with it. If I' ll have less headache running dual WAN using route based, I' ll switch gears and run with it.

RichardHAuthor

New Member

I read page 16 of the " Configuring IPSec VPNs" doc at docs.fortinet.com... I' ll stick with policy based and use a concentrator... I' ll leave this thread open, just in case someone can share some similar experience or guide me.

rwpatterson

New Member

Route based is less configurable. You cannot route over route based to subnets that are not directly attached to the remote FGT. There are issues (I have had) where NATting can be a problem. You probably won' t run into those. Also if you use interface based tunnels, you can place them into a zone, and will have to configure one single policy for all tunnels included in the zone. A definite plus in the maintenance area... My $.02

g3rman

New Member

Richard, interface based tunnels are the way to go. Routed VPN tunnels aren' t exactly legacy but as Bob mentioned interface based VPNs are much more powerful.

RichardHAuthor

New Member

I' ll test route based vpn using zones...

rwpatterson

New Member

Zones require interfaces....

g3rman

New Member

Route based VPNs dont' support zones since you are not creating any additional interfaces.

abelio

SuperUser

Hello all, just for clarify (the thread became confusing for me at least): Routed (= interface) based VPN are those with ACCEPT action firewall policies. On the other side, Policy based VPNs are those with IPSec action firewall policies.