Is it possible to have a Hub and spoke FlexVPN setup where every spoke has the same LAN subnet. I need to configure 6 spokes with the same subnet at each node., I was thinking NAT but I need to access each spokes LAN for management. Any good ideas?
2 Answers
It may be possible, but it's a bad idea. Please don't do it.
You are creating a single broadcast domain over long distance WAN links. This is a poor design because
All broadcast traffic, such as ARPs, no matter what spoke it's sourced from, needs to go to every other spoke, regardless of who it's intended for. On high speed LANs this isn't much of a problem, but on lower speed WAN links, it can be a significant amount of traffic.
The broadcast domain also creates a "failure domain." An improperly configured machine or spanning tree problem, will cause your entire hub and spoke network to fail. Routers and layer 3 boundaries break up failure domains and limit the scope of these kinds of failures.
As I write this, I'm thinking of possible convoluted solutions: VXLANs, etc. While they may work, they will be difficult to manage and maintain. When they break, everything will break.
If you have a critical business requirement that can't be solved any other way, then you can carefully consider a solution like this. But if your rationale is so you don't have to do extra work, like readdressing devices, don't succumb to the temptation -- make separate subnets for the spokes. Your job will be easier, and your network will be more resilient for it.
-
VXLAN is an interesting option I have never heard of that thanks, I agree it's not a normal or sexy configuration. The use case is a meshed ip radio network where the radio's move around alot, but the multiple gateway's (due to RF blocks) are static. All the radio's need to be in the same subnet to manage as they move past the different gateways/spokes. Commented Sep 20, 2019 at 13:42
-
You should post the use case as a separate question. Perhaps some clever person here has an idea. Commented Sep 20, 2019 at 13:46
-
@dee If you coordinate access to the nodes/radios in DNS - register dynamically with current subnet IP when connected - and only use DNS names between nodes you can have a clean, routed network across WAN.– Zac67 ♦Commented Sep 20, 2019 at 14:03
-
If anyone is interested, I used L2TPv3 over Flexvpn to with a BVI at the Hub to fix this issue.