Routing multiple subnets over a site to site VPN

[tsabsuavyaj]

What is the recommended solution to route multiple subnets over a site to site vpn? Does each subnet require its own policy or can one policy be used for one or more subnets if the remote site has more than one subnets? Also, if the remote site router has only two fastethernet interfaces, will it work if configure one of the interfaces with subinterface or as a router on a stick?

[Jitendra Siyag · Accepted solution]

if you are talking about static routing then you can simply add the routes and modify the ACL for encrypted traffic accordingly.

if you want to run dynamic routing. then you will have to IPSEC VTI.  here is the link

http://www.cisco.com/en/US/docs/ios/12_3t/12_3t14/feature/guide/gtIPSctm.html#wp1063136

and though i have not used subinterfaces for IPSEC VTI. but according to me it will work.

[tsabsuavyaj]

Thank you, that's what I wanted to hear.

[Hardik Vaidh]

you can configure loopback host and set as peer for your remote site. and modify the ACL for encrypted traffic accordingly.

you have configure NAT  also and create one ACL for NAT. deny your remote site ip on NAT ACL.

[tsabsuavyaj]

I did and yes it worked as expected.

Thanks,