Site-to-Site VPN with Static and Dynamic Routing

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Site-to-Site VPN with Static and Dynamic Routing

L2 Linker

 

I read the following article about Site to Site VPN With Static and Dynamic Routing.

 

https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/site-to-site-vpn-quick-c... 

 

The article says that the Satellite Site uses static Routing so the VPN Peer A has a static routes toward the Office LAN subnets let's say 172.16.101.0/24 as shown in the topology. And the Regional office Sie uses OSPF Routing Protocol.

The VPN Site to Site is configured between VPN Peer A and VPN Peer B.

A tunnel interface is configured on both palo alto firewalls.

Then OSPF Routing Protocol is implemented between VPN Peer A and VPN Peer B through the Tunnel VPN in area 1.

Finally the VPN Peer B was configured to redistribute the static route to 172.16.101.0/24 into OSPF domain to ensure end to end connectivity.

 

From the scenario explained in the article, we conclude that both VPN Peer A and VPN Peer B are running different routing mechanisms, STATIC Routing and Dynamic Routing.

 

VPN Redi Profile 2.png

 

Do you think that it should be better to do this once on VPN Peer A firewall only, since it has already static routes to the Satellite Subnets, so we can simply configure the VPN Peer A to redistribute these static routes into OSPF Domain as shown below without the need of adding static routes on VPN Peer B, especially in large deployment.

 

VPN Redi Profile 1.png

 

 

2 REPLIES 2

Cyber Elite
Cyber Elite

Hello,

Yeah they made it very complicated in the article on purpose. I prefer OSPF where applicable and static if I have to or need to. 

 

Cheers.

@OtakarKlier  I agree, the scenario is not a good example to explain the route Redistribution concept.

  • 509 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!