A utility is designing IPsec connectivity from its NOC to twelve remote substations, and wants every substation to be able to reach every other substation directly for peer-to-peer protective relay coordination, without routing traffic through the NOC. Which IPsec VPN topology fits this requirement?

A meshed IPsec VPN topology establishes direct tunnels between each pair of sites that need to communicate, which is exactly what's required when substations must reach each other for peer-to-peer relay coordination without transiting a central point. Hub-and-spoke, by contrast, routes all inter-spoke traffic through the hub — here the NOC — which the scenario explicitly rules out, and claiming it adds only negligible latency ignores that the entire point of the requirement is to avoid that hop altogether, not merely to tolerate it. A single dialup phase 1 gateway does not automatically create a meshed data plane; dialup gateways let multiple dynamic peers connect to one static hub, but they do not by themselves establish direct connectivity between the spokes, so the substations still would not reach each other directly through this configuration. Partially redundant topology describes a hub-and-spoke-like design that adds some backup paths for resiliency between select spokes, but it is not defined as the model that avoids all spoke-to-spoke tunnels — it is actually closer to hub-and-spoke than to full mesh, and mischaracterizing it as inherently excluding direct spoke tunnels gets the concept backwards. For a design like this, the practical operational check is to count the phase 1/phase 2 pairs configured on each substation FortiGate — a meshed design scales as roughly n(n-1)/2 tunnels for n sites, which is worth confirming against the utility's device capacity before committing to full mesh at scale.