topic Re: Point to Point VPN with Dynamic IP vs Hub & Spoke in Network Security

Point to Point VPN with Dynamic IP vs Hub & Spoke

Chess Norris — Wed, 26 Oct 2022 10:06:27 GMT

Hello,

When the remote end is using a dynamic IP you have the option in FMC to set the remote end IP address as dynamic, but you can also configure the Site to Site VPN as a "Hub and Spoke". Both types of VPN will use a dynamic crypto ACL, so is there really any difference between the two types of VPN:s?

Thanks

/Chess

Re: Point to Point VPN with Dynamic IP vs Hub & Spoke

Rob Ingram — Wed, 26 Oct 2022 10:35:08 GMT

@Chess Norris there is a difference. A P2P VPN is between 2 peers (regardless whether they are using a dynamic IP on the outside interface). Where as hub and spoke can be used with multiple spokes connected to a hub.

Re: Point to Point VPN with Dynamic IP vs Hub & Spoke

MHM Cisco World — Wed, 26 Oct 2022 12:00:30 GMT

for IOS based device
if you talk about hub and spoke DMVPN and P2P IPsec with dynamic map then the different

P2P IPsec with dynamic map is policy-based VPN
DMVPN is route-based VPN

both used in case the Spoke (in dmvpn) and dynamic peer (in p2p) are initiated the traffic except
in DMVPN there is additional step which is NHRP register.

Re: Point to Point VPN with Dynamic IP vs Hub & Spoke

Rob Ingram — Wed, 26 Oct 2022 11:55:16 GMT

the original post states they are using an FMC, DMVPN is not supported on FTD platform, so misleading/confusing to mention in this context.

Re: Point to Point VPN with Dynamic IP vs Hub & Spoke

Chess Norris — Wed, 26 Oct 2022 12:04:52 GMT

Thanks, I can see now that you can add as much endpoints you want for the Hube and Spoke, but that's not possible with P2P.

I have a lab network at home with a FTD 1010 and a Palo Alto 460 firewall that connects with VPN to my office FTD 2130. I get a different IP address everytime I switch between the FTD and the PA. Since I newer use both firewalls connected at the same time, I guess I can use the same P2P tunnel on the office firewall for both my lab firewalls consider all tunnel settings, ACPs and NAT are the same on both the Palo and the FTD.

/Chess