This blog demonstrate a possible IPsec hub and spoke design with IKEv2 and VTI. The focus here is on an IPsec configuration that is identical on all sides to ensure a consistent configuration. The basic design is shown in the figure below.

Security considerations

In general, this example uses AES (CBC) with at least 256 bits. On newer Cisco routers, it is possible to use AES in GCM mode. GCM is the newer mode compared to CBC. However, there are potential security concerns with GCM if the initial vector is reused. One advantage of GCM is that it combines encryption and integrity, eliminating the need for an additional algorithm for integrity (as is the case with CBC).

Tailscale makes it easy to connect devices securely, but its default settings are designed for convenience rather than strict security. Without a few adjustments, every device in your Tailnet can talk to every other one which in my case I don’t wanted. So I looked into how to raise my security in using Tailscale for accessing my homelab and now share my findings and results.

General Security Advice

Because Tailscale relies on an external identity provider—such as Apple, Microsoft, or Google—it’s essential to secure that account properly.