full mesh or hub and spoke VPNs running OSPF

Reply
Highlighted
hag
L1 Bithead

full mesh or hub and spoke VPNs running OSPF

Hi there,

is anyone managing this with let's say 50 sites and multiple connections (Internet, MPLS).

Currently we are using Juniper and the VPN manager inside the central management (NSM) does this job for us. The good thing is that when you have found a NSM release which is working and has no show stopping bugs it is running really well.

How does Palo Alto solve this.

Thanks for helping me ;-)

Tags (5)
hag
L1 Bithead

Re: full mesh or hub and spoke VPNs running OSPF

Anyone?

L2 Linker

Re: full mesh or hub and spoke VPNs running OSPF

...terminate one or two of your sites to the Palo and evaluate it :smileyhappy:

We just migrated to Palo firewalls and we switched our IPSec VPN architecture over also. We have Cisco routers at a dozen or so remote sites with static public IPs that terminate thier IPSec tunnels back to the Palos at HQ. Prior to switching our VPN over, I did a lot of lab testing with different IPSec VPN scenarios such as full mesh, hub/spoke, static VPN routes and found that I found that the Palos are very versatile and and seem to handle almost any design.

We use Cisco at the remote sites, but Juniper routers should work just as well...the SRX series for example, can do policy based or route based VPN. I used this guide for our set up...but for your Juniper routers you will just have to do some lab testing for the VPN termination architecture.

How to Configure Dynamic Routing over IPSec against Cisco routers:

https://live.paloaltonetworks.com/docs/DOC-2250

As for your stability comment about Juniper releases...I know what you mean. We use the Juniper SA Series and the software releases upset stuff very frequently.

The stability of your new design would be determined by how often you upgrade software on your remote Juniper routers and on the Palo. Because you will be working with the dedicated Palo hardware (vs your current VPN termination approach using the Juniper NSM), I don't expect core features (such as IPSec) on the Palo changing as much where it should cause stability issues with VPN tunnels.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!