Hub and Spoke help

  • I'm trying to get a hub and spoke network working for three sites. At this stage a mesh network is not possible.

    Let's call them Remote A, Remote B and HQ. At the moment HQ is connected to RA and RB, but I can't get traffic between RA and RB (as expected), but my understanding is that a second Phase 2 could solve the problem.

    FYI RA and HQ are both running 2.1.5, while RB is using a Cisco ASA 5505. The Cisco 5505 doesn't support FQDNs which is why a mesh network won't work as RA has a dynamic IP. Hopefully the Cisco ASA 5505 won't be a blocking point. The Cisco box will be replaced with PFSense shortly, but I will still want to get hub and spoke working for other reasons.

    I'm just not sure what subnets to put in the Phase 2 setups. I looked around the forum and there is a mention of such a setup, but it isn't clear to me.

    Any help would be greatly appreciated.


    Hi there.
    Is it possible for Pfsense to for instance have two ipsec tunnels , like A and B where A remote network is and B remote network is so that remote net A can reach remote net B through the IPSEC tunnel to pfsense ? Like a hub and spoke .

  • Rebel Alliance Developer Netgate

    That works fine if you put the right Phase 2 networks on there.

    Tunnel to A
    P2 for Main to A
    P2 for B to A

    Tunnel to B
    P2 for Main to B
    P2 for A to B

    And on the other side, the reverse direction of each.

  • Hi jimp,

    Hope to refresh this thread is OK. I found it by searching and you'll see I'm a newbie.

    I apreciated your answer above pointing to the direction to go but unfortunately I failed.

    I have the main firewall (fixed public ip) and two "satellites" (natted behind routers) each establishing an ipsec tunnel to main (works fine). Now I would like to enable communication between the satellites.

    Main fw:
    Phase1 to sat1
      Phase2 LAN to sat1 (
      Phase2 sat2 ( to sat1 (
    Phase1 to sat2
      Phase2 LAN to sat2 (
      Phase2 sat1 ( to sat1 (

    Phase1 to main
      Phase2 LAN to main (
      Phase2 LAN to sat2 (

    Phase1 to main
      Phase2 LAN to main (
      Phase2 LAN to sat1 (

    What is wrong?

    Thank you or someone else very much in advance!

  • Nothing was wrong - it works!

    Menu: Status - IPSec: Disconnect/Reconnect have to be used!


Log in to reply