topic Re: Hub and Spoke IPsec VPN design with Dynamic Routing in General Topics

Hub and Spoke IPsec VPN design with Dynamic Routing

Theo_White — Tue, 03 Apr 2018 16:21:58 GMT

Looking to properly setup Dynamic Routing over a hub and spoke IPsec VPN network. The hub will have 40-50 spokes. The Hub is running a PA-820. Spokes will be PA-220. Voice and data traffic. There will be minimal traffic between spokes. My questions are;

Is the PA-820 robust enough to handle 40-50 spokes?

Is there any real advantage to using OSPF in this design or will RIPv2 suffice?

Thanks

Re: Hub and Spoke IPsec VPN design with Dynamic Routing

BPry — Tue, 03 Apr 2018 16:53:41 GMT

@Theo_White,

You'll have a max throughput of 400 Mbps with the IPSec traffic, outside of that requirement this should work perfectly fine as long as the rest of the limits fit in line with what you are doing. I'd take a decent look at the datasheet and verify that you wont be hitting any of the limits.

Re: Hub and Spoke IPsec VPN design with Dynamic Routing

Remo — Tue, 03 Apr 2018 16:58:42 GMT

Product comparison between PA-220, PA-820, PA-850 and PA-3220

https://www.paloaltonetworks.com/products/product-comparison.html?chosen=pa-820,pa-220,pa-3220,pa-850

At least regarding your spec sheet your setup will work as already mentionned by @BPry

Re: Hub and Spoke IPsec VPN design with Dynamic Routing

OtakarKlier — Thu, 05 Apr 2018 18:34:08 GMT

Hello,

I would use OSPF but thats just my choice. If the spoke sites dont change and all traffic is tunneled back to the hub, then even static routing would work.

Regards,