What are impacts of adding many subnets to crypto map ACL for Site-to-site VPN?

[Tats0611]

Hi everyone,

I would like to know what would be the impacts of adding many subnets to crypto map ACLs for Site-to-site VPN.

Currently HQ and new branch office is connected with IPsec site-to-site VPN over internet.

I would like New branch to have access to other branch offices through HQ.

I know it would work if I added the branch offices subnets to the current crypto map ACLs but I do not know the impact of adding many subnets to a crypto map ACL to route traffic over site-to-site VPN.

the number of subnets that I would like to add is about 20 subnets.

I am hoping stability and performance will be same as current Site-to-site VPN setting.

Can anyone please tell me your thoughts?

I attached a diagram that is simple and small version of what I want to do.

Best regards,

Tats

[Lyle Erding]

Have you considered using DMVPN as an alternative. That way you could treat it as routed traffic and have it participate in OSPF with your other locaitons. You could choose to run the tunnel in gre multi-point to allow spoke-to-spoke communications if you add other VPN branches in the future or leave it as point-to-point to force all traffic back through the hub. If you add other locations in the future there wouldn't be any need to change the configuration on the HQ hub, only add the needed configuration on the new branch router that you deploy.

[Tats0611]

---

Hi Lyle,

Thanks for your reply.

No we have not considered DMVPN as I am quite new to network stuff and do not know much about DMVPN. Also we are using Meraki MX68 at NewBranch and I saw MX68 only support ikev1 IPsec VPN only with non-Meraki device in a documentation.

But your suggestion sounds nice and clean if we would open other new branches in the future.

Thanks,

Tats

[GRANT3779 · Accepted solution]

There is no real impact as such. You would need to ensure matching encryption domain at each end.

It is when you start having large encryption domain with specific ports / source / destinations etc.. that it sometimes becomes more efficient to allow IP between subnets in the encryption domain and then lock it down with a VPN-Filter.

Are you running an ASA as your 2 VPN endpoints? If so, you could look at using VTI tunnel, route based VPN rather than the current policy based VPN. You would then lose the Crypto ACL altogether.

[Tats0611]

Hi GRANT3779,

Thanks for your reply.

That is good to hear that there is no real impact.

I am running an ASA at HQ and Meraki MX68 at NewBranch. Basically ikev1 IPsec vpn is the only choice.

Thanks,

Tats