When IPsec VPNs are designed, what is a unique requirement if support for IP Multicast is required?

The correct answer is A. encapsulation of traffic with GRE or VTI. To enable IP Multicast support over an IPsec VPN, traffic must first be encapsulated using a tunneling protocol like GRE or VTI before being protected by IPsec.

WAN for Enterprise Networks

Question

Options

Aencapsulation of traffic with GRE or VTI
BIPsec forwarding using transport mode
Cadditional bandwidth for headend
DIPsec forwarding using tunnel mode

How the community answered

(58 responses)

A
86% (50)
B
2% (1)
C
5% (3)
D
7% (4)

Why each option

To enable IP Multicast support over an IPsec VPN, traffic must first be encapsulated using a tunneling protocol like GRE or VTI before being protected by IPsec.

Aencapsulation of traffic with GRE or VTICorrect

IPsec inherently lacks the capability to forward multicast traffic directly. To transport IP Multicast over an IPsec VPN, the multicast packets must be encapsulated within another tunnel protocol, such as Generic Routing Encapsulation (GRE) or Virtual Tunnel Interface (VTI), before IPsec encrypts the resulting unicast tunnel. This allows the multicast traffic to traverse the IPsec tunnel as if it were unicast.

BIPsec forwarding using transport mode

Cadditional bandwidth for headend

DIPsec forwarding using tunnel mode

Concept tested: IPsec VPN multicast support with GRE/VTI

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpntun/configuration/xe-3s/sec-ipsec-vpn-tun-xe-3s-book/sec-ipsec-vpn-ipmulticast.html

Topics

#IPsec VPN#Multicast#GRE over IPsec#VTI

Community Discussion

No community discussion yet for this question.

Full 300-420 Practice