300-320 · Question #689
What are some limitations of VTI? (Select two.)
The correct answer is C. It is limited to only IP unicast and multicast traffic, as opposed to GRE tunnels, which have a D. IPsec stateful failover is not supported with IPsec VTIs. Virtual Tunnel Interfaces (VTI) are a simplified IPsec tunneling method but come with two notable limitations. First, VTIs can only carry IP unicast and multicast traffic-they cannot carry non-IP protocols or Layer 2 frames. GRE tunnels, by contrast, can encapsulate virtually…
Question
What are some limitations of VTI? (Select two.)
Options
- AIt doesn't support multicast.
- BIt requires more established SAs to cover different types of traffic such as unicast and multicast.
- CIt is limited to only IP unicast and multicast traffic, as opposed to GRE tunnels, which have a
- DIPsec stateful failover is not supported with IPsec VTIs.
How the community answered
(52 responses)- A10% (5)
- B19% (10)
- C71% (37)
Explanation
Virtual Tunnel Interfaces (VTI) are a simplified IPsec tunneling method but come with two notable limitations. First, VTIs can only carry IP unicast and multicast traffic-they cannot carry non-IP protocols or Layer 2 frames. GRE tunnels, by contrast, can encapsulate virtually any Layer 3 protocol (IPX, MPLS, etc.) because GRE includes a protocol type field. Second, IPsec stateful failover (where IPsec Security Associations survive a failover event and traffic continues without re-establishing SAs) is not supported with VTIs. Regarding the other choices: VTIs do support multicast (eliminating choice A as a limitation), and VTIs actually require fewer SAs than crypto map-based IPsec-not more-making choice B incorrect.
Topics
Community Discussion
No community discussion yet for this question.