02 Policy-based vs Route-based VPN
The difference between these two models decides how a tunnel is configured, how far it scales and which vendors work well together. It is where most multi-vendor VPNs fail (for example Palo Alto ↔ Meraki).
Contenido complementario
Not covered in my courses. Verified against Palo Alto and Meraki documentation (see Sources).
Policy-based
A policy decides which traffic goes into the tunnel: an ACL (classic Cisco crypto map), Proxy IDs (Palo Alto when the peer is policy-based) or Private subnets (Meraki). Each subnet pair is an SA.
- Pro: easy to understand; works with older devices.
- Cons: changing subnets means touching both ends; SAs grow with the combinations; no dynamic routing inside the tunnel.
With IKEv1, m local subnets and n remote subnets give T = 2 × m × n SAs (formula from the Meraki documentation). With IKEv2, Meraki sends one aggregated selector and needs only 2.
Route-based
The tunnel is a virtual interface (Tunnel Interface on Palo Alto, VTI on Cisco/Meraki). Traffic enters the tunnel because the routing table points it at that interface. The selectors are 0.0.0.0/0 ↔ 0.0.0.0/0 and don’t restrict anything: routes decide.
- Pros: adding a subnet means adding a route (or letting BGP advertise it); supports dynamic routing; fewer SAs.
- Cons: both ends must support it; you have to watch for routing loops.
graph LR subgraph "Policy-based" P1["ACL / Proxy IDs / Private subnets<br/>decide what gets encrypted"] end subgraph "Route-based" R1["Routing table → tunnel interface<br/>decides what gets encrypted"] end
Comparison
| Policy-based | Route-based | |
|---|---|---|
| What selects the traffic | Selectors | Routes |
| Changing subnets | Both ends | Routes (or BGP) |
| Dynamic routing | No | Yes (BGP/OSPF) |
| SAs | One per pair (IKEv1) | Usually one |
| Virtual interface | No | Yes |
| Palo Alto | Only to interoperate (Proxy IDs) | Native |
| Meraki MX | IKEv1 and IKEv2 (IKEv2 policy-based being phased out from MX 26.2) | IKEv2: dynamic (BGP) ≥ 19.1.4, static ≥ 26.2 |
How Palo Alto handles it (documented)
- With no Proxy ID configured, PAN-OS uses
0.0.0.0/0 ↔ 0.0.0.0/0with applicationany: it is route-based by default. A policy-based peer cannot match that with IKEv1. - With IKEv1 it accepts only an exact Proxy ID match; with IKEv2 it supports narrowing.
- Each Proxy ID counts as a tunnel against the firewall’s IPsec capacity.
- If the traffic is NATed, the Proxy IDs must use the post-NAT addresses.
When to choose each
- Old device without route-based support: policy-based with IKEv1 and Proxy IDs (IPsec PA a Meraki (IKEv1 y proxy IDs)).
- New or growing design: route-based with BGP (BGP sobre IPsec PA a Meraki).
- Interoperating with an Auto VPN network: route-based, because traffic arriving over Auto VPN cannot be routed into a policy-based tunnel (see Auto VPN).
Self-check
Q1 — What decides which traffic enters a route-based tunnel?
A) A crypto map ACL
B) The Proxy IDs
C) The routing table
D) The phase 2 lifetime
Respuesta
C. In route-based VPNs the selectors are broad and routes point to the tunnel interface. A) and B) are policy-based mechanisms. D) has nothing to do with traffic selection.
Q2 — With IKEv1, an MX with 3 subnets and a peer with 4 subnets. How many SAs in total (T = 2 × m × n)?
A) 7
B) 12
C) 24
D) 2
Respuesta
C: 2 × 3 × 4 = 24. B) forgets the factor 2 (one per direction). D) is what IKEv2 would need with an aggregated selector, not IKEv1.
Q3 — Why can't an Auto VPN spoke reach the Palo Alto through the hub when the hub–PA tunnel is policy-based?
A) Because IPsec doesn’t support spokes
B) Because traffic arriving over an Auto VPN tunnel cannot be routed into a policy-based IPsec tunnel
C) Because the PA doesn’t accept IKEv2
D) Because the PSK is different
Respuesta
B, per the Meraki documentation on policy-based limitations. The fix is a route-based tunnel (BGP or static routes). A), C) and D) are not the cause.
Q4 — What do 0.0.0.0/0 selectors mean in a route-based tunnel?
A) All the site’s traffic is sent through the tunnel
B) The tunnel goes down
C) They don’t restrict anything; routes decide what enters
D) Only ICMP traffic passes
Respuesta
C. Broad selectors only keep the SA from blocking traffic; traffic enters only if a route points to the tunnel interface. A) would create a loop and doesn’t happen. B) and D) are false.