topic Full mesh for multi site over broadband in General Topics

Full mesh for multi site over broadband

MarioMarquez — Mon, 14 Jan 2019 00:33:31 GMT

I have a few PA 200's all with base license ready to install for a multisite company that needs a full mesh all over broadband internet. I am willing to manually configure each IPsec tunnel one by one if that is a good free option that does not require additional licensing. Can someone give me advice on the best way to accomplish this setup and what licensing is needed for the options given? I do have Panorama.

Re: Full mesh for multi site over broadband

Chacko42 — Mon, 14 Jan 2019 09:33:25 GMT

you can also do LSVPN and GlobalProtect - no additional licensing required.

Unfortunately you can currently build hub-spoke topologies only, but that will help you with setting up the tunnels with less administrative effort

Re: Full mesh for multi site over broadband

MarioMarquez — Mon, 14 Jan 2019 13:47:40 GMT

Thanks. Does that feature have a license I can buy to do a full mesh? What are your thoughts on manually building a full mesh using standard ipsec configuration for each tunnel? Is it just the time & labor that is the set back or will production be at some sort of risk?

Re: Full mesh for multi site over broadband

Chacko42 — Mon, 14 Jan 2019 13:57:26 GMT

full meshed topology is currently not supported/configurable.

you will need a GP license only, if you want to support HIP profiles or mobile devices.

No, static tunnels are fine, but the amount of tunnels needed with raising branch offices is huge.

Tunnels needed with n full meshed sites: (n*(n-1)/2