300-730 · Question #100
Which technology and VPN component allows a VPN headend to dynamically learn post NAT IP addresses of remote routers at different sites?
The correct answer is C. DMVPN with NHRP. DMVPN uses NHRP to let spoke routers dynamically register their post-NAT public IP addresses with the hub, enabling tunnel endpoint resolution across NAT boundaries.
Question
Options
- ADMVPN with ISAKMP
- BGETVPN with ISAKMP
- CDMVPN with NHRP
- DGETVPN with NHRP
How the community answered
(42 responses)- A2% (1)
- B7% (3)
- C86% (36)
- D5% (2)
Why each option
DMVPN uses NHRP to let spoke routers dynamically register their post-NAT public IP addresses with the hub, enabling tunnel endpoint resolution across NAT boundaries.
ISAKMP is a key management and negotiation protocol; it handles authentication and SA establishment but has no mechanism to register or resolve tunnel endpoint IP addresses.
GETVPN is designed for trusted MPLS cores where all devices share a single SA and routable addresses; it does not support dynamic NAT traversal or NHRP-style endpoint registration.
In a DMVPN topology, NHRP (Next Hop Resolution Protocol) functions as a dynamic address registration mechanism where each spoke registers its current public IP - including addresses translated by NAT - with the NHS running on the hub. This allows the hub to maintain an up-to-date mapping of spoke tunnel endpoints even when those IPs change, which is the core requirement for dynamic post-NAT IP learning.
GETVPN does not use NHRP and is architecturally incompatible with the dynamic post-NAT IP discovery described in the question.
Concept tested: DMVPN NHRP dynamic spoke registration and post-NAT IP learning
Source: https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/WAN_and_MAN/DMVPN/DMVPN_2.html
Topics
Community Discussion
No community discussion yet for this question.