300-730 · Question #165
Refer to the exhibit. Which type of VPN tunnel is configured? [Exhibit: Configuration snippet] `` interface Tunnel119 ip address 172.20.58.7 255.255.0.0 ip mtu 1400 ip tcp adjust-mss 1360 tunnel…
The correct answer is D. GRE over IPsec. The configuration shows a point-to-point GRE tunnel with a static destination address and an IPsec protection profile applied, which defines a GRE over IPsec tunnel.
Question
interface Tunnel119
ip address 172.20.58.7 255.255.0.0
ip mtu 1400
ip tcp adjust-mss 1360
tunnel source GigabitEthernet0/1
tunnel destination 128.17.64.8
tunnel protection ipsec profile DMVPN_PROFILE
end
Options
- AMultipoint GRE
- BDMVPN
- CFlexVPN
- DGRE over IPsec
How the community answered
(19 responses)- A5% (1)
- B5% (1)
- C11% (2)
- D79% (15)
Why each option
The configuration shows a point-to-point GRE tunnel with a static destination address and an IPsec protection profile applied, which defines a GRE over IPsec tunnel.
Multipoint GRE requires tunnel mode gre multipoint and NHRP configuration, neither of which appears in this configuration.
DMVPN requires multipoint GRE mode, NHRP network-id and map statements, and typically ip nhrp commands, none of which are present here.
FlexVPN uses IKEv2, virtual-template interfaces, and ip address negotiated or unnumbered on tunnel interfaces, none of which appear in this configuration.
The tunnel interface uses tunnel destination with a single static unicast IP address, making it a point-to-point GRE tunnel, not multipoint. The tunnel protection ipsec profile command applies IPsec encryption to the GRE tunnel traffic, resulting in the classic GRE over IPsec design where GRE encapsulates the original packet and IPsec encrypts the resulting GRE packet in tunnel mode. There is no tunnel mode gre multipoint command, no NHRP configuration, and no virtual-template/IKEv2 constructs present.
Concept tested: Identifying GRE over IPsec tunnel from interface configuration
Source: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/14137-gre-ipsec.html
Topics
Community Discussion
No community discussion yet for this question.