cancel
Showing results for 
Search instead for 
Did you mean: 

Unique vs. Hub-and-Spoke

Here to help

Unique vs. Hub-and-Spoke

I have understood that for automatic address assignment in Site-to-Site VPN I have to use a template. With it each site gets its own IP addresses from a defined pool. For a hub and spoke network I need to configure the MXs as spokes. the hub site as I see it cannot be part of the template because of the selection of the type "Hub".

 

If I want to select an IP address for a VLAN on the hub out of a range in the template that is used in the spokes: does the dashboard track the used IP subnet so that it is never assigned to a spoke? Or do I have to assign IP addresses in a different IP address range? (reason for asking: FW rules would be easier in general if IP addresses for VLANs with the same purpose could reside in a common address range)

3 REPLIES
A model citizen

Re: Unique vs. Hub-and-Spoke

You'll want to assign the hub an IP range outside of the subnet used for the spoke sites to avoid overlap.

Highlighted
Kind of a big deal

Re: Unique vs. Hub-and-Spoke

>does the dashboard track the used IP subnet so that it is never assigned to a spoke

 

Yes.

Here to help

Re: Unique vs. Hub-and-Spoke

Hi Philipp

even though in some configuration situations I received error messages about overlapping IP subnets and I was not able to proceed I was able to configure my network in a way to have overlapping IP subnets. This was the case when I added a spoke site that used the pool of IP subnets out of the template. I do not know why the tests work when trying to add a hub site with overlapping IP addresses but not in the case where a spoke site gets an IP address out of the pool.

So I think that the best strategy is still to use non-overlapping address spaces for hub and spokes, but that was clear in the first place.

Thanks for taking the time for replying my (silly) questions.

Matthias

 

Screenshot 2018-12-10 at 10.40.37.png