Sometimes depending on the network architecture you find your traffic inside a tunnel encapsulated inside another and maybe also inside another tunnel. So double to tripple encryption without that much of a security benefit. When the clients already establishing a VPN connection there is no need for the S2S encryption tunneling. We only getting smaller and smaller packets through the pipe because of the overhead of each IPsec tunnel reducing the MTU further.

This blog demonstrate a possible IPsec hub and spoke design with IKEv2 and VTI. The focus here is on an IPsec configuration that is identical on all sides to ensure a consistent configuration. The basic design is shown in the figure below.

Security considerations

In general, this example uses AES (CBC) with at least 256 bits. On newer Cisco routers, it is possible to use AES in GCM mode. GCM is the newer mode compared to CBC. However, there are potential security concerns with GCM if the initial vector is reused. One advantage of GCM is that it combines encryption and integrity, eliminating the need for an additional algorithm for integrity (as is the case with CBC).