NSE4 · Question #238
What advantages are there in using a hub-and-spoke IPSec VPN configuration instead of a fully- meshed set of IPSec tunnels? (Select all that apply.)
The correct answer is B. Using a hub and spoke topology simplifies configuration. D. Using a hub and spoke topology reduces the number of tunnels. Hub-and-spoke IPSec VPN simplifies configuration and reduces the total number of tunnels compared to a fully-meshed topology.
Question
What advantages are there in using a hub-and-spoke IPSec VPN configuration instead of a fully- meshed set of IPSec tunnels? (Select all that apply.)
Options
- AUsing a hub and spoke topology is required to achieve full redundancy.
- BUsing a hub and spoke topology simplifies configuration.
- CUsing a hub and spoke topology provides stronger encryption.
- DUsing a hub and spoke topology reduces the number of tunnels.
How the community answered
(63 responses)- A3% (2)
- B95% (60)
- C2% (1)
Why each option
Hub-and-spoke IPSec VPN simplifies configuration and reduces the total number of tunnels compared to a fully-meshed topology.
Full redundancy is often more directly achieved with a full-mesh topology, or requires additional redundant hubs in a hub-and-spoke setup, making it not inherently simpler or required for full redundancy.
A hub-and-spoke topology significantly simplifies VPN configuration because each spoke site only needs to establish a single tunnel to the central hub, rather than a tunnel to every other site.
The choice of VPN topology (hub-and-spoke vs. full-mesh) does not impact the strength of the encryption algorithms used; encryption strength is determined by the configured cipher suites and key lengths.
For N sites, a hub-and-spoke topology requires N-1 tunnels (one from each spoke to the hub), which is a much lower number compared to the N*(N-1)/2 tunnels required for a full-mesh topology.
Concept tested: VPN topology comparison (Hub-and-Spoke vs. Full Mesh)
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/963009/ipsec-vpn-to-multiple-spokes
Topics
Community Discussion
No community discussion yet for this question.