Policy-based VPNs
The tunnel is defined by policies listing source and destination subnets. Traffic matching those pairs is encrypted. Adding a subnet means changing the policy on both sides.
Route-based VPNs
The tunnel appears as a virtual interface. Any traffic routed to that interface is encrypted. Routing — static or dynamic — decides what goes through.
Why route-based usually wins
- Supports BGP over the tunnel, so routes update automatically.
- Easier to add networks without renegotiating policies.
- Simpler failover between multiple tunnels.
When policy-based is fine
Very simple, static connections between two fixed subnets.
Peer1IX recommendation
Use route-based tunnels with BGP for connections into the Peer1IX fabric whenever your equipment supports it.
