A utility has forty substations but wants to limit the number of tunnels each substation FortiGate must maintain, while still giving the NOC central visibility and control over inter-substation traffic. Which topology trades off full mesh connectivity for that centralized control?
Select an answer to reveal the explanation.
Short Explanation
Hub-and-spoke is the trade-off dial for this exact problem: each substation only has to maintain one tunnel — to the NOC — instead of one for every other substation it might talk to, and all inter-substation traffic gets funneled through the NOC where it can be inspected and controlled centrally.
Full Explanation
Hub-and-spoke IPsec topology designates one site, here the NOC, as the hub, with every spoke — each substation — maintaining a single tunnel to that hub rather than to every other site. Traffic between two spokes transits the hub, which both reduces the per-device tunnel count from potentially dozens down to one per substation, and gives the NOC a natural inspection and policy point for all inter-substation traffic, matching both stated goals in the scenario. The claim that a meshed topology also reduces tunnel count per site to one is incorrect and inverts the trade-off being tested — mesh is precisely the topology where tunnel count per site grows with the number of peers it needs to reach directly, which is the opposite of what limits per-device tunnel maintenance here. Dialup phase 1 configuration addresses how a peer with a dynamic IP is identified during negotiation; it does not by itself create centralized routing or inspection, and asserting it centralizes traffic without a hub device confuses an authentication mechanism with a topology decision. A collection of independent point-to-point tunnels with no shared gateway is simply a description of a full mesh built one tunnel at a time — it does not reduce tunnel count and provides no centralized visibility, so it fails both stated requirements. Operationally, an engineer can validate a hub-and-spoke design by confirming spoke FortiGates show exactly one phase 1 gateway to the NOC in 'diagnose vpn ike gateway list', with all substation-to-substation routes pointing at the hub's tunnel interface.