nerdexam
Cisco

300-730 · Question #165

Refer to the exhibit. Which type of VPN tunnel is configured? [Exhibit: Configuration snippet] `` interface Tunnel119 ip address 172.20.58.7 255.255.0.0 ip mtu 1400 ip tcp adjust-mss 1360 tunnel…

The correct answer is D. GRE over IPsec. The configuration shows a point-to-point GRE tunnel with a static destination address and an IPsec protection profile applied, which defines a GRE over IPsec tunnel.

Site-to-site VPNs on Routers and Firewalls

Question

Refer to the exhibit. Which type of VPN tunnel is configured? [Exhibit: Configuration snippet]
interface Tunnel119
ip address 172.20.58.7 255.255.0.0
ip mtu 1400
ip tcp adjust-mss 1360
tunnel source GigabitEthernet0/1
tunnel destination 128.17.64.8
tunnel protection ipsec profile DMVPN_PROFILE
end

Options

  • AMultipoint GRE
  • BDMVPN
  • CFlexVPN
  • DGRE over IPsec

How the community answered

(19 responses)
  • A
    5% (1)
  • B
    5% (1)
  • C
    11% (2)
  • D
    79% (15)

Why each option

The configuration shows a point-to-point GRE tunnel with a static destination address and an IPsec protection profile applied, which defines a GRE over IPsec tunnel.

AMultipoint GRE

Multipoint GRE requires tunnel mode gre multipoint and NHRP configuration, neither of which appears in this configuration.

BDMVPN

DMVPN requires multipoint GRE mode, NHRP network-id and map statements, and typically ip nhrp commands, none of which are present here.

CFlexVPN

FlexVPN uses IKEv2, virtual-template interfaces, and ip address negotiated or unnumbered on tunnel interfaces, none of which appear in this configuration.

DGRE over IPsecCorrect

The tunnel interface uses tunnel destination with a single static unicast IP address, making it a point-to-point GRE tunnel, not multipoint. The tunnel protection ipsec profile command applies IPsec encryption to the GRE tunnel traffic, resulting in the classic GRE over IPsec design where GRE encapsulates the original packet and IPsec encrypts the resulting GRE packet in tunnel mode. There is no tunnel mode gre multipoint command, no NHRP configuration, and no virtual-template/IKEv2 constructs present.

Concept tested: Identifying GRE over IPsec tunnel from interface configuration

Source: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/14137-gre-ipsec.html

Topics

#GRE over IPsec#tunnel configuration#tunnel protection#point-to-point tunnel

Community Discussion

No community discussion yet for this question.

Full 300-730 Practice