Hub and Spoke SDWAN? (remote and local IP on vpn)

[userzer0]

Hey all,

I'm struggling with something super simple. I'm working through the "Hub and spoke SD-WAN deployment example" in the admin guide, trying to set one up in real life.  Some of the configuration elements, specifically the local and remote IPs on the tunnels is throwing me for a loop though.

in the admin guide, on the hub side, (on each tunnel interface) they're using an IP for the hub's tunnel interface IP and then a /24 network for the remote-ip:

config system interface
edit "vpn-isp-a"
set vdom "root"
set ip 10.254.0.1 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 10.254.0.254 255.255.255.0
set interface "port2"
next
edit "vpn-isp-b"
set vdom "root"
set ip 10.254.1.1 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 10.254.1.254 255.255.255.0
set interface "port3"
next
end

But on the spoke side they're using a completely different set of IPs on each tunnel interface, with a /32 for the remote-ip:

config system interface
edit "vpn_dc1-1"
set vdom "root"
set ip 10.255.0.2 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 10.255.0.1 255.255.255.255
set interface "port2"
next
edit "vpn_dc1-2"
set vdom "root"
set ip 10.255.1.2 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 10.255.1.1 255.255.255.255
set interface "port3"
next
end

Can someone explain to me how this works?

Thanks in advance!

[gfleming]

If your hub and majority of spokes will eventually have dual WANs then keep the hub with two tunnel interfaces in separate subnets. Just tie them to WAN1 for now.

I would also keep it simple and just map WAN1 tunnel to remote WAN1 tunnel and WAN2 tunnel to remote WAN2 tunnel.

https://docs.fortinet.com/document/fortigate/7.2.0/sd-wan-architecture-for-enterprise/242149/ipsec-o...