How to configure VPN tunnels with large number of encryption domain entries

[albaker1]

Our Firepowers have several tunnels that have a large number of lines (30+) in the access-lists that defined the encryption domain. When using FortiConverter to migrate the VPN configuration, we now have some tunnels with over 30 entries in IPsec phase 2. This has resulting in hundreds of phase 2 entries - this is unwieldy. I noticed you can define groups within phase 2, so in lieu of 30+ entries, we can drop this down to a single entry, which we want. 

Am I too simplistic in thinking this will work? Are there any caveats or gotchas for doing this? Is there a better approach?

Thank you.

[adambomb1219]

You can also just use 0.0.0.0/0 and then control access via firewall policy.

[albaker1]

I don't think we're talking about the same thing here. The encryption domains has to match on both ends for the sa's to form. This doesn't have anything to do with the firewall policy.

[adambomb1219]

We are, are these not FortiGates on both sides?  You are correct though, the encryption domains must match on both sides, I was under the impression you had control of both peers.

[albaker1]

We don't have control. We probably have a dozen vendor VPNs that terminate to various DMZs. I know some are Cisco firewalls and routers, one is Checkpoint, and the rest I have no clue. I was hoping to use network groups within phase 2 to condense the configuration.