Site-to-Site VPN with Static and Dynamic Routing

rmeddane — Tue, 12 Dec 2023 17:49:24 GMT

I read the following article about Site to Site VPN With Static and Dynamic Routing.

https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/site-to-site-vpn-quick-configs/site-to-site-vpn-with-static-and-dynamic-routing

The article says that the Satellite Site uses static Routing so the VPN Peer A has a static routes toward the Office LAN subnets let's say 172.16.101.0/24 as shown in the topology. And the Regional office Sie uses OSPF Routing Protocol.

The VPN Site to Site is configured between VPN Peer A and VPN Peer B.

A tunnel interface is configured on both palo alto firewalls.

Then OSPF Routing Protocol is implemented between VPN Peer A and VPN Peer B through the Tunnel VPN in area 1.

Finally the VPN Peer B was configured to redistribute the static route to 172.16.101.0/24 into OSPF domain to ensure end to end connectivity.

From the scenario explained in the article, we conclude that both VPN Peer A and VPN Peer B are running different routing mechanisms, STATIC Routing and Dynamic Routing.

Do you think that it should be better to do this once on VPN Peer A firewall only, since it has already static routes to the Satellite Subnets, so we can simply configure the VPN Peer A to redistribute these static routes into OSPF Domain as shown below without the need of adding static routes on VPN Peer B, especially in large deployment.

Re: Site-to-Site VPN with Static and Dynamic Routing

OtakarKlier — Tue, 12 Dec 2023 20:29:12 GMT

Hello,

Yeah they made it very complicated in the article on purpose. I prefer OSPF where applicable and static if I have to or need to.

Cheers.

Re: Site-to-Site VPN with Static and Dynamic Routing

rmeddane — Tue, 12 Dec 2023 20:58:03 GMT

@OtakarKlier I agree, the scenario is not a good example to explain the route Redistribution concept.

topic Re: Site-to-Site VPN with Static and Dynamic Routing in Next-Generation Firewall Discussions

Site-to-Site VPN with Static and Dynamic Routing

Re: Site-to-Site VPN with Static and Dynamic Routing

Re: Site-to-Site VPN with Static and Dynamic Routing