IPsec Phase 2

[ehsangha]

Hi everyone.

I have a question about IPsec phase 2 in FortiGate. I need to create nearly 60 IPsec site-to-site tunnels. At the center site, we have 8 different subnets. Is it better to create a separate Phase 2 for each subnet or use 0.0.0.0/0 as the local and remote site in Phase 2?

[funkylicious]

i personally find 0.0.0.0/0 selectors to give you more flexibility and its easier to scale any changes.

[sw2090]

indeed. It only gets quite obfuscating with so many phase2s :)

I also tend to use an open (i.e. 0.0.0.0/0) p2 selector and then do the rest with routing and policies.

[Toshi_Esumi]

In addition, that's the size of network you want to use routing protocol either OSPF or BGP.

Toshi

[ede_pfau]

If both sides/sites use Fortigates, I'd use an address group as 'named address'. Make it routeable, right from the start. Then I use it in

- phase2

- policy

- static route

And for 60 s2s VPNs, use a template and script it, along with the address groups.

Using the wildcard '0.0.0.0/0' is a FortiOS speciality.

[Yurisk]

Provided that at both ends you have Fortigates (e.g. Checkpoint doesn't play well with 0.0.0.0) then using 0.0.0.0 for the encryption domain would be a common practice, usually you also run BGP or (less so - OSPF) on them to advertise subnets of each other, and this way save yourself configuring static routes on remote FGTs.