IPsec Phase 2

[ehsangha]

Hi everyone.

I have a question about IPsec phase 2 in FortiGate. I need to create nearly 60 IPsec site-to-site tunnels. At the center site, we have 8 different subnets. Is it better to create a separate Phase 2 for each subnet or use 0.0.0.0/0 as the local and remote site in Phase 2?

[funkylicious]

i personally find 0.0.0.0/0 selectors to give you more flexibility and its easier to scale any changes.

[sw2090]

indeed. It only gets quite obfuscating with so many phase2s :)

I also tend to use an open (i.e. 0.0.0.0/0) p2 selector and then do the rest with routing and policies.

[Toshi_Esumi]

In addition, that's the size of network you want to use routing protocol either OSPF or BGP.

Toshi