2

I am confused about the major difference between a policy-based VPN and routed-based site-site Vpn

Improve this question
2
  • In addition to what Eddie said, if you're weighing which to use in a setup and have the option for both, route-based is usually also paired with BGP, which makes route (or tunnel) preferencing possible (like when used with AWS or Azure) because there's no way to control it from the AWS/Azure side. They do respect whatever prepending you may do on your advertisements though. It also makes it much easier to maintain because you can inject routes on either side and it can automatically update the remote side without the need to touch crypto map ACLs or NAT exemption statements.
    – Jesse P.
    Aug 23 '20 at 21:48
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Dec 17 '20 at 20:51
4

The difference between Route based VPN and Policy based VPN is how you indicate what type of traffic should be encrypted and sent through the VPN tunnel.

In a Route based VPN, you establish IP addresses which are the tunnel end points -- for Cisco, it would be the interface tunnel0 IP address. Then any networks you route to that packet will be encrypted and sent through the tunnel.

In a Policy based VPN, you establish the tunnel, then specifically identify the IP networks who's communication should go through the tunnel. Typically this is done with an Access List identifying which IP address(es) are speaking through the tunnel.

Generally, the functional difference with these two is the Route based VPN creates one set of IPsec tunnels which all tunneled traffic flows between. And the Policy Based VPN creates one set of IPsec tunnels for each combination of IP networks you specify.

Improve this answer
2
  • 2
    So you mean to say that in policy based routing interesting traffic will flow on basis of access-list. In route based vpn interesting traffic will flow on basis of route entry cofigured pointing towards peer ip . For example ip route 10.0.0.0 255.255.255.0 gatway peer ip of remote network... Is my understanding is correct..
    – Sunilsp
    Aug 24 '20 at 5:28
  • @Sunilsp Yep. Exactly.
    – Eddie
    Aug 24 '20 at 7:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.