I am confused about the major difference between a policy-based VPN and routed-based site-site Vpn
-
In addition to what Eddie said, if you're weighing which to use in a setup and have the option for both, route-based is usually also paired with BGP, which makes route (or tunnel) preferencing possible (like when used with AWS or Azure) because there's no way to control it from the AWS/Azure side. They do respect whatever prepending you may do on your advertisements though. It also makes it much easier to maintain because you can inject routes on either side and it can automatically update the remote side without the need to touch crypto map ACLs or NAT exemption statements.– Jesse P.Aug 23, 2020 at 21:48
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.– Ron Maupin ♦Dec 17, 2020 at 20:51
1 Answer
The difference between Route based VPN and Policy based VPN is how you indicate what type of traffic should be encrypted and sent through the VPN tunnel.
In a Route based VPN, you establish IP addresses which are the tunnel end points -- for Cisco, it would be the interface tunnel0
IP address. Then any networks you route to that packet will be encrypted and sent through the tunnel.
In a Policy based VPN, you establish the tunnel, then specifically identify the IP networks who's communication should go through the tunnel. Typically this is done with an Access List identifying which IP address(es) are speaking through the tunnel.
Generally, the functional difference with these two is the Route based VPN creates one set of IPsec tunnels which all tunneled traffic flows between. And the Policy Based VPN creates one set of IPsec tunnels for each combination of IP networks you specify.
-
2So you mean to say that in policy based routing interesting traffic will flow on basis of access-list. In route based vpn interesting traffic will flow on basis of route entry cofigured pointing towards peer ip . For example ip route 10.0.0.0 255.255.255.0 gatway peer ip of remote network... Is my understanding is correct..– user70077Aug 24, 2020 at 5:28
-