AD-VPN stands for Auto-Discovery VPN. It provides the BENEFITS of full mesh topology within a Hub & Spoke topology. This is key, its not an actual full-mesh setup but it gives those benefits. It is build upon IKE & IPsec.
For example if we have 3 sites. London and Birmingham are spoke sites, and Manchester is the Hub site. If London & Birmingham want to communicate in a Hub & Spoke topology, they'd have to traverse through the hub firewall. While this is fine in terms of security posture and less configuration required on the spokes it does have its disadvantages.
Disadvantages of Hub & Spoke
- If spokes have to always go through hubs this can introduce delays and worse user experience, especially if the sites are very far away or geographically separated from each other. For example, if Birmingham was actually LA, and London wanted to speak to LA, this is very far away.
- If Hub & Spoke causes these issues, alternative is Full-Mesh topology which can become expensive (dependant on number of spokes) but allows all spokes to directly talk to each other.
- If a Full-Mesh is decided upon then this increases the amount of administration required as more IPsec tunnels to configure, monitor and maintain.
Comments