I am confused about the major difference between a policy-based VPN and routed-based site-site Vpn
-
In addition to what Eddie said, if you're weighing which to use in a setup and have the option for both, route-based is usually also paired with BGP, which makes route (or tunnel) preferencing possible (like when used with AWS or Azure) because there's no way to control it from the AWS/Azure side. They do respect whatever prepending you may do on your advertisements though. It also makes it much easier to maintain because you can inject routes on either side and it can automatically update the remote side without the need to touch crypto map ACLs or NAT exemption statements. – Jesse P. Aug 23 at 21:48
The difference between Route based VPN and Policy based VPN is how you indicate what type of traffic should be encrypted and sent through the VPN tunnel.
In a Route based VPN, you establish IP addresses which are the tunnel end points -- for Cisco, it would be the interface tunnel0 IP address. Then any networks you route to that packet will be encrypted and sent through the tunnel.
In a Policy based VPN, you establish the tunnel, then specifically identify the IP networks who's communication should go through the tunnel. Typically this is done with an Access List identifying which IP address(es) are speaking through the tunnel.
Generally, the functional difference with these two is the Route based VPN creates one set of IPsec tunnels which all tunneled traffic flows between. And the Policy Based VPN creates one set of IPsec tunnels for each combination of IP networks you specify.
-
2So you mean to say that in policy based routing interesting traffic will flow on basis of access-list. In route based vpn interesting traffic will flow on basis of route entry cofigured pointing towards peer ip . For example ip route 10.0.0.0 255.255.255.0 gatway peer ip of remote network... Is my understanding is correct.. – Sunilsp Aug 24 at 5:28
-
