Need new VPN design

[maced129]

Hi, I am working for a company that has over 100 sites that are connected to HQ via encrypted vpn tunnels. We currently do the old style crypto map and defined ACL for GRE over IPSEC tunnels back to HQ...so we are doing a hub/spoke design.

I am looking for a new way to deploy these VPNs as we are growing all the time, the sites will never have to talk to other sites...just to HQ so I'm not sure if DMVPN is the right choice for us.

Do you guys have any suggestions for any new ways that we could deploy these new sites? Maybe VTI/DVTI??

Any help is appriciated...

[Marcin Latosiewicz]

Miles,

DMVPN for sure has this nice scalability factor which might be good for you.

VTI might also be a good idea, it's the stuff that gets a bit more traction in terms of supportability and new features coming.

I would base the actual solution on a few questions:

- Traffic volume

- Redundancy/Availability

- Support for protocols (will you need IPX, IPv6)

- Platforms you would like to deploy on (are there platforms witch very specific forwarding mechanisms - ASR, 6500/7600 with VPN SPA/VPNSM...)

- Third party devices support (?)

- Designated routing mechanism could be also of some importance.

(... probably a bunch of others...)

Marcin