I am working on building out the S2S tunnels and I noticed that the internal IPs of the remote site show as the "unsafe" outside WAN Zone. I am now trying to find a better solution to identify the traffic and do it the right way to separate the traffic from being blocked or filtered to much via the Access Rules. To reduce the amount of policy object that it would need to go through and go straight to what it needs. I was looking at the pre-filter and looking at adding a tunnel rule but from reading documentation I don't believe that is what I am looking for.
Right now I have 13 sites in total I am connecting. I have 2 peer to peer connections that talk only to the server vlans with no intrusion policy as things are heavily shared such as nutanix infrastructure requires for Disaster recovery. Then I have our "Remote stores"/client to server on a hub and spoke with intrusion policy and certain services. I have also a geoblock rule blocking all but usa and canada enabled top level which also causing an issue because its blocking traffic due to it not being able to identify whether it was USA or not.
Here is the part I need someone to help talk me through. So I am going to setup a Route based VTI using hub and spoke topology but my ftd device doesnt seem to show as available hub. I then started reading documentation that dynamic VTI is need. So went to my interfaces and saw the dynamic option is greyd.
Not exactly sure if its limitation with the FTD or if it has to be doing with a pre-req that I am missing for this to work. If thats the case then most likely I will need a VTI for each location and go that way? Also is this the best way to separate traffic to be able to filter correctly by the interface in use?
