IPsec tunnels based on virtual IPsec interfaces (VTI) in a hub and spoke configuration

This example is a variation of the scenario in which tunnels are based on virtual IPsec interfaces (VTI) between the LILLE and PARIS sites. In addition to encrypted exchanges between the LILLE and PARIS sites, the PARIS site uses IPsec tunnels to access the Internet via one of the LILLE WAN access links.

The architecture is the same as the one used for tunnels based on virtual IPsec interfaces (VTI) between the LILLE and PARIS sites. As such, it will not be explained in this section.

Only the imperative settings relating to the type of router object to be used for routing on each site, as well as the NAT rules to create on the LILLE site, will be described in this section.

LILLE site

In a hub & spoke configuration, traffic on the LILLE site can be routed:

  • Over a default route through a router object that uses failover between both its gateways,
  • Over policy-based routing (PBR) through a router object that uses failover between both its gateways,
  • Over a static route through a router object that uses failover between both its gateways,

Load balancing cannot be used in the router object in this case: it is not compatible with unprotected source interfaces, which is the default setting for virtual IPsec interfaces.

PARIS site

In a hub & spoke configuration, traffic on the PARIS site can be routed:

  • Over a default route through a router object that uses failover between both its gateways,
  • Over a static route through a router object that uses failover between both its gateways,
  • Over policy-based routing (PBR) through a router object that uses failover between both its gateways,
  • Over policy-based routing through a router object that uses load balancing, on the condition that the virtual IPsec interfaces of the PARIS site have been declared unprotected, which is the default configuration. Setting up load balancing with gateways that are based on protected interfaces will raise identity spoofing alarms that will block packets on the LILLE firewall.