Traditionally i have always set IPSEC policies as /24 (/16 etc) on routers that had policies for encrypting IPSEC traffic (as opposed to routes).

I have since started using a router (Fortinet) that allows routes to be set to route traffic over VPN connections.

Say for example i have the following sites:

Site A:


Site B:


Given i want to setup OSPF to route the above subnets, what IP addresses should i assign to each router?

Can I use /30 subnets for the site to site links?

Any other best practice or recommendations for the above?

1 Answer 1


Yes, a /30 is a perfectly valid option for any point-to-point network from router to router. If that network happens to be an IPsec tunnel, it's all the same. Of course you'll have to select a subnet and address that does not overlap with another one in your network.

Routers have been supporting /31 for quite a while - even if the first and last address in a /31 are network and broadcast address.

Usually, OSPF copes well with that, too.

Which addresses you choose for your point to point links is up to your addressing plan entirely.

Some admins prefer to pick an IP range entirely unrelated to any end system's IP subnets, and allocate their /30s and /31s, but also the /32s for the Loopback addresses from there. This has some benefits when traffic filtering at the network edge is meant to protect the routers; a filter configuration becomes pretty simple - just add a deny rule with the given IP range.

Personally (and this is now opinionated), I try to pick one larger block (say, a /18) for an entire IPv4 network of a given customer, large enough to cover all the customer's sites and leave some room to grow. Then I would allocate a suitable sub-range at the end or the beginning thereof (like, a /23), which is then split up as needed for transit networks, (typically some /28, leaving room for two or three tuples of HSRP/VRRP) and /30 or /31 for point-to-point and for Loopback (/32) addresses. This approach, when working with traceroutes, helps end system's admins, supporters and also the newby network admin to spot where traffic starts to leave the given customer's network. As long as the first-two-octets-and-some-more-digits of the IP addresses showing up in traceroute output remain the same as on their end systems, they can tell if traffic is still within the given customer's network or not.

  • Excellent thank you, very well and concisely explained - so i could use for site A loopback of, and site B loopback of I then set my P2P IPSEC addresses of site A side and site B side of Maybe off topic and i can open a second question, why would one not simply use the loopback addresses as the tunnel endpoints?
    – morleyc
    Mar 10, 2019 at 10:15
  • Not quite: and /31 are not on the same subnet (.0 & .1 would be, and .2 & .3 as well ). If the given platform supports ip unnunmbered <ifName> then the tunnel interface can "borrow" another (usually a Loopback) interface's IP address as interface address; then there is no need for a /30 or a /31. OSPF does work well with unnumbered interfaces, but you have to make sure that the borrowed IP address/interface is enabled for OSPF, and I've seen cases that required the OSPF interface type to be set to point-to-point before accepting an ip unnumbered config. Mar 10, 2019 at 12:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.