Firewall policy placement for IPsec VPN/SD-WAN

[Magnitude_8]

I’m curious to know at which end of a VPN tunnel most people apply restrictions.

My thoughts are that you should apply restrictions near the device you’re trying to protect. So I would allow all traffic from a branch office to a hub and restrict access to servers at the hub. I suppose the restrictions could be applied on the branch firewall only, or at both ends.

How do you implement firewall policies in your environment? Are you aware of a documented best practice?

[AEK]

As you said I apply the protection near the protected device.

If I have servers on hub side I protect them on the hub firewall, instead of protecting the same servers on every branch firewall, while on branch firewalls I protect the clients.

[Rajan_kohli]

Hi @Magnitude_8 ,

Most of the time security policies are required on VPN Tunnel traffic because it is considered safe traffic at most of the time but if you wish to have a security policy you can have them on any side of the tunnel but be aware that it might affect the throughput of the tunnel.

Regards

Rajan