Site-to-Site VPN with Static and Dynamic Routing

[rmeddane]

I read the following article about Site to Site VPN With Static and Dynamic Routing.

https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/site-to-site-vpn-quick-c... 

The article says that the Satellite Site uses static Routing so the VPN Peer A has a static routes toward the Office LAN subnets let's say 172.16.101.0/24 as shown in the topology. And the Regional office Sie uses OSPF Routing Protocol.

The VPN Site to Site is configured between VPN Peer A and VPN Peer B.

A tunnel interface is configured on both palo alto firewalls.

Then OSPF Routing Protocol is implemented between VPN Peer A and VPN Peer B through the Tunnel VPN in area 1.

Finally the VPN Peer B was configured to redistribute the static route to 172.16.101.0/24 into OSPF domain to ensure end to end connectivity.

From the scenario explained in the article, we conclude that both VPN Peer A and VPN Peer B are running different routing mechanisms, STATIC Routing and Dynamic Routing.

Do you think that it should be better to do this once on VPN Peer A firewall only, since it has already static routes to the Satellite Subnets, so we can simply configure the VPN Peer A to redistribute these static routes into OSPF Domain as shown below without the need of adding static routes on VPN Peer B, especially in large deployment.

[OtakarKlier]

Hello,

Yeah they made it very complicated in the article on purpose. I prefer OSPF where applicable and static if I have to or need to. 

Cheers.

[rmeddane]

@OtakarKlier  I agree, the scenario is not a good example to explain the route Redistribution concept.