Basic S2S crypto ACL question

[neteng2323]

We have FTD.  I have a Dynamic S2S tunnel with an any/any defined to a bunch of Cradlepoints as that's how I was able to get it to work at the time.  

Will creating a new Static tunnel with any/any defined for the local and remote networks cause a conflict between these 2 tunnels?  In other words, can you just have one any/any tunnel in the same FW instance/environment?

[balaji.bandi]

Personally, i would not advise having any any / that is not security best practice, Do specific route based or subnet based allow list respected VPN is good practice

[neteng2323]

I agree.  I plan to fix it.  My question is can it cause a problem to have more than one tunnel with any/any defined?

[balaji.bandi · Accepted solution]

YES / NO depends on the setup and behaviour ( never done any /any - if more than 1 tunnel for my self)