- An advanced mesh VPN network connects each site to the others using direct, fault-tolerant IPsec tunnels.
- The combination of IKE, well-aligned VPN policies, and aggregated subnets simplifies management and improves security.
- High availability is reinforced with active-active gateways, BGP, and various VPN devices both on-premises and in the cloud.
- Mesh Wi-Fi, managed services, and solutions like eero Plus or Fortinet complete a secure and scalable ecosystem.
When a company grows and spreads across multiple offices, cloud sites, and remote workers , connecting everything securely and quickly ceases to be optional and becomes business-critical. Traditional point-to-point VPN technologies fall short in flexibility and fault tolerance, and that's where advanced mesh VPN comes in.
This type of architecture allows each site or traffic source to establish direct encrypted tunnels with all other locations , avoiding bottlenecks in a single hub and offering high availability, improved performance, and seamless integration with modern approaches such as zero trust or hybrid environments (on-premises + cloud). Throughout this article, we will break down how these networks work, their technical requirements (IPsec, IKE, BGP, routers, and firewalls), and how they fit with current mesh Wi-Fi solutions and managed services.
What is an advanced mesh VPN network and how does it differ from other models?
An advanced mesh VPN is a topology where each site establishes VPN tunnels with every other site , so communication between any two points doesn't depend on a third party being available or acting as an intermediary. This configuration is also known as a full mesh or decentralized VPN.
Instead of a classic hub-and-spoke design (all locations hanging from a central hub), the advanced mesh opts for a distributed architecture , ideal when resources are spread across several locations or when resilient business processes are desired that continue to function even if one location has connectivity problems.
In a typical scenario, each firewall or security device—for example, a Firebox at each site —creates IPsec tunnels to the others. If the corporate office goes down, the branch office and distribution center continue to communicate directly over the VPN, without going through headquarters.
This approach fits very well with Zero Trust Network strategies , where security is designed assuming that any part of the network can fail or be compromised, and where end-to-end encryption, segmentation, and resilience are prioritized.
Use cases: from the multi-site enterprise to the hybrid environment with the cloud
A very common use case for an advanced mesh VPN is that of an organization with multiple locations: for example, a colocation facility (Colo), a corporate headquarters (Corp), a distribution center (Dist), and a small remote office (RMT). In this context, each site needs direct and secure access to the resources of the others.
In this type of design, unique resources may exist in one of the locations (for example, a critical ERP at headquarters or an enterprise file server ), so reliable connectivity between all sites is essential. The more remote offices are added, the more important it becomes that the system supports adding new nodes without reconfiguring everything.
When most resources are concentrated in a single location, a classic centralized architecture can still make sense . However, if data and applications are distributed, or if there are business processes that require direct communication between sites (for example, constant synchronization between logistics centers), a fully integrated network offers greater flexibility and fault tolerance.
A particularly common scenario is the combination of on-premises networks and the cloud , for example, by connecting on-premises networks to Azure via VPN Gateway and also creating virtual network-to-virtual network (VNet-to-VNet) connections. In these hybrid environments, mesh topologies and advanced redundancy mechanisms are key to ensuring service continuity.
Essential technical components of an advanced mesh VPN network
Behind the label “mesh VPN” lies a series of very specific technical components that make the magic possible. Broadly speaking, we're talking about advanced VPN security features such as IPsec for data encryption and IKE (Internet Key Exchange) for key exchange and negotiation of security parameters between endpoints.
In a typical Firebox or other next-generation firewall configuration, each site defines branch gateways and tunnels that connect to the networks of the other sites. For example, in a four-location organization, each site will have three branch VPN gateways and three associated tunnels (one to each of the other sites).
Configuration is usually managed through specific tools (such as Policy Manager in Fireware), where you can view and adjust both branch gateways and branch VPN tunnels , as well as the tunnel routes needed for traffic to travel between local and remote subnets.
A very important detail in mesh networking scenarios is the use of aggregated subnets when defining tunnel routes instead of listing each local network separately. For example, the "Colo to RMT" tunnel can be defined to use the 172.16.0.0/16 subnet to represent all of Colo's internal networks (e.g., 172.16.1.0 and 172.16.2.0), so that a single pair of tunnel routes can cover multiple segments instead of requiring multiple tunnels.
This drastically reduces the number of tunnel routes required, especially in small offices that only need to reach a limited set of remote subnets. However, if very fine traffic control is required , individual networks can be defined, at the cost of more configuration and administration work.
Infrastructure requirements: bandwidth, hardware, and reliability
An advanced mesh VPN is, by definition, more demanding than a simple setup. Each tunnel involves encryption and encapsulation processes , so the usable bandwidth of the VPN will always be somewhat less than the physical speed of the link.
Therefore, companies must ensure that the links between sites (fiber, MPLS, high-capacity internet, etc.) have sufficient bandwidth to support the encrypted traffic that will flow through the tunnels. This is especially critical in locations that house unique resources or that act as communication hubs.
The type of security device deployed at each point (for example, a Firebox appropriate for the size of the site; consult router manuals and datasheets ) is equally important. Each model offers a specific maximum VPN speed and simultaneous tunnel capacity, so undersizing this equipment is not advisable if bottlenecks are to be avoided.
In practical terms, the number of VPN tunnels usually depends on the number of local and remote networks to be connected (as defined in the tunnel routes). In a typical office, the calculation approximates the number of local networks multiplied by the number of remote networks, unless aggregated subnets are used.
It is also essential to ensure reliable connectivity at sites hosting critical services. Although mesh architecture tolerates failures in an isolated node, if that node contains essential applications or data, any connectivity problem at that point will result in service outages for the rest of the sites.
IPsec, IKE and security profiles: the heart of the VPN
An advanced mesh VPN network relies, at the protocol level, on the combination of IPsec for data encryption and IKE (Internet Key Exchange) for key exchange and negotiation of security parameters between endpoints.
IKE is the protocol that establishes a Security Association (SA) between two points; that is, the mutual agreement on how traffic will be encrypted and authenticated. For a VPN to function reliably, the IKE policies of both ends must match in all relevant parameters (authentication method, encryption and authentication algorithms, Diffie-Hellman groups, time-to-live, etc.).
In routers like the Cisco RV110W, an IKE policy is defined indicating, among other things, the exchange mode (primary or aggressive), the encryption algorithm (DES, 3DES, AES-128, AES-192, AES-256), the authentication algorithm (MD5, SHA-1, SHA2-256), the pre-shared key, and the Diffie-Hellman group (for example, group 1 of 768 bits, group 2 of 1024 bits, or group 5 of 1536 bits).
In addition to the IKE policy, VPN policies are defined that determine what traffic is protected through the tunnel, what network identifiers are used for the local and remote ends (single IP address or subnet), and whether the policy is automatic (with IKE negotiation of keys and parameters) or manual (all keys and SPI configured by hand on both ends).
Manual policies specify hexadecimal values for incoming and outgoing SPI, encryption keys (Key-In and Key-Out) and integrity algorithms (MD5, SHA1, SHA2-256), ensuring that the remote device uses exactly the same values so that the tunnel can be established correctly.
Advanced profiles: “IPsec required”, “IPsec optional” and clear traffic
In more sophisticated mesh network environments, in addition to the classic configuration of tunnels between sites, advanced connection profiles are often created that determine when the use of IPsec is mandatory and when clear traffic is allowed.
For example, three profiles can be defined: one where IPsec is mandatory (only encrypted traffic is allowed), another where encryption is optional (either encrypted or plaintext traffic is accepted depending on the destination), and a third that only allows unencrypted traffic . In systems based on ipsec.conf, these profiles are described with connection blocks (conn) that specify the connection type (passthrough or transport), the authentication mode (e.g., rsasig with certificates), the shunt parameters in case of failure (drop or passthrough), and references to RSA certificates and keys.
A typical example is having a passthrough connection without authentication for the "No IPsec" profile, another transport connection with RSA signature authentication and failure termination policies for "IPsec required", and a third transport connection with RSA signatures but with permissive behavior (passthrough) in case of failure for "IPsec optional".
Combining these profiles with the appropriate routes allows for the implementation of adaptive security strategies , where certain critical flows must always be encrypted, while others can circulate in plain text on high-trust internal networks, or opportunistically leverage IPsec when both ends allow it.
VPN policy configuration in detail
For each VPN policy, in addition to the IKE parameters, it is necessary to specify which traffic will be encapsulated in the tunnel . Source and destination networks are typically chosen using identifiers such as "Single" (single host) or "Subnet".
If "Single" is selected, the policy applies to a specific IP address (for example, a specific server). If a "Subnet" is defined, the policy covers a range of addresses determined by the combination of network IP and subnet mask ; devices are protected by the VPN when their IP falls within that range.
In the case of automated policies , in addition to the Security Association lifetime (in seconds), encryption and integrity algorithms are selected, and Perfect Forward Secrecy (PFS) is optionally enabled with an additional Diffie-Hellman group. This adds a layer of security by generating new session keys that are not solely dependent on the master key.
In any scenario, it must be ensured that lifetimes, encryption algorithms, integrity algorithms, PFS groups, and even the selected IKE policy match at both ends of the tunnel. Otherwise, the negotiation will fail, or the tunnel will crash when the SA expires and an attempt is made to renegotiate.
Professional-grade routers often offer extra features, such as Dead Peer Detection (DPD) , which monitors whether a peer is still active and removes obsolete entries to free up resources. DPD typically allows you to adjust the frequency of checks and the timeout before considering a peer "dead."
High availability in the cloud: Azure VPN Gateway in advanced mesh
When an advanced mesh VPN connects on-premises networks to Azure infrastructure , Azure VPN Gateway and its various redundancy options come into play. By default, each Azure VPN Gateway instance consists of two instances in an active-standby configuration.
In the event of planned maintenance or unforeseen incidents, if the active instance becomes unavailable, the standby instance takes over, and the site-to-site (S2S) or virtual network-to-virtual network (V2N) tunnels are automatically restored. For planned outages, recovery typically takes 10–15 seconds; for unplanned failures, it can take 1–3 minutes. For point-to-site (P2S) VPN client connections, sessions are disconnected, and users must reconnect.
To improve the availability of connections between the local network and Azure, several schemes can be chosen: using multiple local VPN devices (for example, having two VPNs installed ), configuring VPN Gateway instances in active-active mode in Azure, or combining both for double redundancy that fits perfectly into a mesh topology.
With multiple on-premises VPN devices, several S2S connections are created from each device to the Azure gateway, defining a distinct on-premises network gateway per device, each with a unique public IP address and BGP peer address . Using BGP and Equal Cost Per Mechanism (ECMP), traffic is distributed across multiple active tunnels in parallel.
In Azure VPN Gateway's active-active mode, each gateway instance has its own public IP address and establishes an S2S IPsec/IKE tunnel to the on-premises VPN device, forming two tunnels that actually belong to the same connection. From Azure, both tunnels are used simultaneously, increasing availability and enabling better traffic distribution.
Complete mesh between on-premises and Azure: double redundancy
The most robust option for an advanced mesh VPN that combines cloud and on-premises environments is to configure dual redundancy : active-active gateways in Azure and, simultaneously, multiple VPN devices on the on-premises network. The result is a kind of complete mesh with four IPsec tunnels between the Azure virtual network and the on-premises environment.
In this design, all gateways and tunnels are kept active on the Azure side, and traffic is distributed across the four links . Each TCP/UDP flow typically follows the same tunnel from Azure's perspective, but the combined flows are distributed across the four, which slightly improves overall performance and, most importantly, provides very high fault tolerance.
To implement this topology, two local network gateways and two different connections for the two local VPN devices are required, always backed up by BGP to allow simultaneous connectivity to the same on-premise network through multiple connections.
The same approach can be applied to virtual network-to-virtual network connectivity within Azure: active-active gateways are created in each virtual network and connected to each other to also obtain four active tunnels between the VNets. In this case, BGP is optional, unless transit traffic needs to be routed through that connection.
With this type of architecture, cloud networks cease to be mere satellites of the local network and become fully-fledged nodes in the VPN mesh , providing much flexibility when moving workloads, balancing applications, and designing business continuity plans.
Mesh Wi-Fi and VPN: a perfect combination in the corporate network
The concept of "mesh" isn't limited to VPNs. In the realm of Wi-Fi, solutions like eero and its TrueMesh technology have demonstrated that using multiple interconnected access points is a highly effective way to eliminate dead zones, minimize dropouts, and reduce dreaded buffering in home and small office environments.
Instead of a single Wi-Fi router trying to cover the entire house or office, a mesh Wi-Fi network distributes multiple eero devices throughout the space, allowing clients to always connect to the nearest and most stable access point . TrueMesh intelligently redirects traffic based on factors such as the physical layout of the nodes, interference from neighboring networks, and the load of connected devices.
Depending on internet usage, different models are recommended: eero 6+ as an affordable gigabit system, eero Pro 6E for connections up to 2 Gbps and many simultaneous devices, or eero Max 7 for advanced users with wifi 7, hundreds of devices and maximum performance needs both wired and wireless.
All these devices are compatible with major internet providers and with each other, allowing for gradual expansion or upgrades of the Wi-Fi network . Furthermore, they receive automatic software updates with security patches and feature enhancements—a crucial point when Wi-Fi is the primary access point for a corporate VPN.
Digital home, security and centralized management with eero
Beyond basic connectivity, modern eero systems integrate smart home features thanks to compatibility with Thread, Zigbee, and Matter (using Alexa as a controller). In practice, this means that many smart home devices can connect directly to the eero network without the need for additional hubs.
The eero app allows you to configure a Thread device, for example, by enabling the option in Network Settings → Thread , or to leverage the Zigbee hub by integrating your eero and Amazon accounts under the Amazon Connected Home section. Once this is done, you can add compatible devices using the Alexa app or any Echo speaker on the network.
For day-to-day management, eero makes device administration easy: you can assign devices to individual profiles (to group, for example, the devices of each family member), apply wifi pause schedules (very useful for limiting usage at certain times) and easily rename each device to identify them without going crazy.
It is also possible to enable notifications to receive alerts when a new device joins the network, and to create a separate guest network with its own name and password, thus keeping the main network more isolated and controlled.
In combination with VPN services—such as the VPN access included via Guardian within the eero Plus subscription—the user has an additional layer of encryption when connecting from their mobile phone or tablet to external networks, perfectly complementing more corporate mesh VPNs.
Additional security services: eero Plus and VPN for end users
The eero Plus subscription adds a range of advanced security features geared towards end users and small organizations: enhanced protection, parental controls, backup internet , and integration with three well-known applications: 1Password (password manager), Malwarebytes (malware protection), and Guardian (VPN service).
With content filters, parents can define restrictions by category—shopping, social media, chats and messaging, streaming—so that specific devices only have access to appropriate content. This type of control works particularly well in environments where the Wi-Fi mesh network and the corporate VPN share the same home infrastructure.
The Backup Internet feature allows eero to automatically connect to a mobile hotspot or other available network when the primary provider goes down, and you can choose which devices stay connected during the outage to optimize available bandwidth.
In the area of personal security, integration with Malwarebytes offers protection against online threats on up to three compatible devices, while 1Password facilitates the secure management and storage of credentials , which is essential when working with corporate VPN access, administration panels, and cloud services.
Finally, Guardian offers an end-user-oriented VPN , accessible directly from the eero app, which encrypts traffic from the device (mobile or tablet) to the internet, ideal for connections from public or untrusted Wi-Fi networks. While this type of VPN doesn't replace an advanced corporate mesh network, it complements end-user protection very well.
Site-to-site VPN: pillars for a robust design
In a corporate context, every advanced mesh VPN network is fundamentally built from multiple site-to-site VPNs . For these connections to be robust and easy to operate at scale, it is essential to take care of five key components.
The first is technological security in companies : use of robust cryptographic algorithms (AES with 128/192/256 bit keys, SHA-2), proper key management, PFS, DPD and good hardening practices on perimeter devices.
The second pillar is ease of operation : consistent policies across locations, reusable configuration templates, centralized management and monitoring tools, and clear processes for adding new locations or changing parameters.
Third is simple and secure scalability , which means being able to add locations without redesigning the entire topology, taking advantage of techniques such as subnet aggregation, the use of BGP for dynamic routing, and deployment automation.
The last two pillars are business continuity —ensuring that a node or link failure does not leave the sites isolated— and flexible implementation , that is, the ability to deploy the VPN in different environments (on-premise, public cloud, multiple clouds) while maintaining consistent security policies.
Managed VPN services and dedicated security products
For many organizations, especially those without a large in-house networking and security team, using managed VPN services can be a very sensible decision. These services outsource some of the complexity: topology design, hardware selection, IPsec/IKE policy configuration, 24/7 monitoring, incident response, and ongoing maintenance.
Security vendors like Fortinet offer dedicated products and services for building and managing site-to-site VPNs and advanced mesh networks, integrating firewalls, SD-WAN, deep packet inspection, web filtering, and other layers of protection. In this way, the VPN ceases to be a simple "encrypted tunnel" and becomes one component of a layered security architecture.
In large networks, with dozens or hundreds of sites, these solutions drastically reduce the operational load: they allow you to define global policies , deploy them on multiple devices, manage certificates, firmware updates and configuration changes in an orchestrated way, and obtain centralized visibility of the status of all tunnels.
Whether you opt for in-house management or an outsourced service, the key is that the mesh VPN keeps pace with the organization: supporting new locations, new cloud services, traffic spikes, and changes in security needs without becoming a hindrance to the business.
Designing and operating an advanced mesh VPN involves combining a distributed architecture across multiple sites, careful IPsec/IKE configuration, high-availability strategies (both on-premises and in the cloud), a reliable mesh Wi-Fi foundation, and, in many cases, additional security and management services. By integrating all these elements—from “IPsec required/optional” profiles and active-active redundancy to BGP, solutions like eero Plus, and professional firewall platforms—organizations can build secure, scalable, and fault-tolerant networks that connect offices, homes, and clouds without sacrificing performance or flexibility.
