IPsec Phase 2

[ehsangha]

Hi everyone.

I have a question about IPsec phase 2 in FortiGate. I need to create nearly 60 IPsec site-to-site tunnels. At the center site, we have 8 different subnets. Is it better to create a separate Phase 2 for each subnet or use 0.0.0.0/0 as the local and remote site in Phase 2?

[funkylicious]

i personally find 0.0.0.0/0 selectors to give you more flexibility and its easier to scale any changes.

[sw2090]

indeed. It only gets quite obfuscating with so many phase2s :)

I also tend to use an open (i.e. 0.0.0.0/0) p2 selector and then do the rest with routing and policies.

[Toshi_Esumi]

In addition, that's the size of network you want to use routing protocol either OSPF or BGP.

Toshi

[ede_pfau]

If both sides/sites use Fortigates, I'd use an address group as 'named address'. Make it routeable, right from the start. Then I use it in

- phase2

- policy

- static route

And for 60 s2s VPNs, use a template and script it, along with the address groups.

Using the wildcard '0.0.0.0/0' is a FortiOS speciality.

[Yurisk]

Provided that at both ends you have Fortigates (e.g. Checkpoint doesn't play well with 0.0.0.0) then using 0.0.0.0 for the encryption domain would be a common practice, usually you also run BGP or (less so - OSPF) on them to advertise subnets of each other, and this way save yourself configuring static routes on remote FGTs. 

[ehsangha]

I appreciate everyone's responses. I received my response. Could someone please explain to me what's happening in the FortiGate routing table when we put 0.0.0.0/0 in phase 2 IPsec? and whether they clash if we have 0.0.0.0/0 directed to the WAN interface?

[Toshi_Esumi]

The IPsec phase2 selector has almost nothing to do with the routing table. It's just a filter what kind of traffic (source and destination) to be passed over the IPsec tunnel with the SA. When you make it as 0/0<->0/0, all traffic is eligible to go over/come through the tunnel. 
No impact to your FGT's routing table.

Toshi