Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ehsangha
New Contributor

IPsec Phase 2

Hi everyone.

I have a question about IPsec phase 2 in FortiGate. I need to create nearly 60 IPsec site-to-site tunnels. At the center site, we have 8 different subnets. Is it better to create a separate Phase 2 for each subnet or use 0.0.0.0/0 as the local and remote site in Phase 2?

3 REPLIES 3
funkylicious
SuperUser
SuperUser

i personally find 0.0.0.0/0 selectors to give you more flexibility and its easier to scale any changes.

"jack of all trades, master of none"
"jack of all trades, master of none"
sw2090
SuperUser
SuperUser

indeed. It only gets quite obfuscating with so many phase2s :)

I also tend to use an open (i.e. 0.0.0.0/0) p2 selector and then do the rest with routing and policies.

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
Toshi_Esumi
SuperUser
SuperUser

In addition, that's the size of network you want to use routing protocol either OSPF or BGP.

Toshi

Announcements
Check out our Community Chatter Blog! Click here to get involved
Labels
Top Kudoed Authors