Benefits Very easy to configure and maintain The Spoke-to-Spoke links are established on demand whenever there is traffic between the spokes. The following packets are then able to bypass the Hub and use the Spoke-to-Spoke tunnel After a pre-configured amount (=time) of inactivity on the Spoke-to-Spoke tunnels, the router will tear down those tunnels in order to save resources (IPsec SAs). In this way, even the low end routers (like Cisco 1600, 1700) can participate in large (1000 nodes) IPsec VPNs, if they don't have too many simultaneous Spoke-to-Spoke tunnels. Limitations Traffic profile should be following the 80-20 rule: 80% of the traffic SPOKE-to-HUB and only 20% or less SPOKE-to-SPOKE traffic.
PIX supports DPD v6.0+; it supports HSRP+ like functionality today 3000 supports DPD v3.0+ and RRI in v3.5+; it supports HSRP+ like functionality with the clustering feature (load balancing not HA) IOS supports HSRP+ and RRI in 12.1(9)E and 12.2(8)T and DPD in 12.2(8)T and 12.2(1)S