topic Limit Hub and Spoke PA 460 in General Topics

Limit Hub and Spoke PA 460

Cristian_Soler — Thu, 07 Sep 2023 01:24:31 GMT

We have done the creation of a tunnel (VPN) as hub and spoke, currently we will connect 203 devices to this tunnel, we have been researching but we have not found information on how many peers this tunnel can support with this hub and spoke configuration? Does anyone know the limit of devices that can be linked to the same tunnel?

If there is documentation on this information, could you please share it?

Re: Limit Hub and Spoke PA 460

Alin.Scarlat — Thu, 07 Sep 2023 03:39:03 GMT

Hello @Cristian_Soler ,

According to the product specification, a PA-460 can have maximum of 2800 IPSec Site-to-Site VPN peers.

Please find more information on this link by searching for your product.

I hope this helps.

Re: Limit Hub and Spoke PA 460

Cristian_Soler — Thu, 07 Sep 2023 04:08:20 GMT

Thanks for the answer

We only want to have one (1) VPN on this PA-460, we don't want to configure site to site, but site to many sites.
In theory if my PA-460 is my HUB and the other devices(Forti, Cisco, etc) are the spoke for a total of 203.
Could I say that with a single tunnel (Ipsec) configured on my PA 460 I can support up to 2800 spoke at the same time through that single tunnel we will have

Re: Limit Hub and Spoke PA 460

Alin.Scarlat — Fri, 08 Sep 2023 17:44:43 GMT

Hello @Cristian_Soler ,

In theory, even if you have a single tunnel interface in a hub-and-spoke topology, you would have multiple ISAKMP and IPSec sessions, one for each spoke (like Cisco has with DMVPN and other VPN technologies). As far as I know, a tunnel interface can have up to 250 proxy IDs.

The information presented above is the platform limit presented by Palo Alto regarding IPSec VPNs.

I hope this helps.

Re: Limit Hub and Spoke PA 460

BPry — Tue, 12 Sep 2023 03:18:55 GMT

@Cristian_Soler,

Keep in mind that you'll hit your proxy-id limit for a single tunnel well before you'd hit your max IKE limit. Seeing as you already have 203 peers I'd be cautious on what your actual proxy-id requirements will be at present, and what they'll be going forward if you intend to see any growth.