nerdexam
Cisco

300-730 · Question #17

In FlexVPN, what is the role of a NHRP resolution request?

The correct answer is A. It allows these entities to directly communicate without requiring traffic to use an intermediate hop. In FlexVPN, NHRP resolution requests allow a spoke to discover another spoke's tunnel endpoint address so the two can build a direct IPsec tunnel without routing through the hub.

Site-to-site VPNs on Routers and Firewalls

Question

In FlexVPN, what is the role of a NHRP resolution request?

Options

  • AIt allows these entities to directly communicate without requiring traffic to use an intermediate hop
  • BIt dynamically assigns VPN users to a group
  • CIt blocks these entities from to directly communicating with each other
  • DIt makes sure that each VPN spoke directly communicates with the hub

How the community answered

(35 responses)
  • A
    74% (26)
  • B
    9% (3)
  • C
    14% (5)
  • D
    3% (1)

Why each option

In FlexVPN, NHRP resolution requests allow a spoke to discover another spoke's tunnel endpoint address so the two can build a direct IPsec tunnel without routing through the hub.

AIt allows these entities to directly communicate without requiring traffic to use an intermediate hopCorrect

When a spoke needs to reach another spoke, it sends an NHRP resolution request to the hub acting as the Next Hop Server, which returns the physical NBMA address of the destination spoke. With this mapping resolved, the requesting spoke establishes a direct dynamic IPsec tunnel to the target spoke, bypassing the hub entirely for subsequent traffic. The resolved NHRP cache entry is maintained so the direct tunnel persists as long as traffic flows between those two spokes.

BIt dynamically assigns VPN users to a group

Dynamic assignment of VPN users to groups is handled by IKEv2 authorization policies and AAA, not by NHRP resolution requests, which are strictly used for tunnel endpoint address discovery.

CIt blocks these entities from to directly communicating with each other

NHRP resolution requests enable direct communication between spokes rather than blocking it - they return the information needed to build a direct tunnel, which is the opposite of preventing communication.

DIt makes sure that each VPN spoke directly communicates with the hub

Spoke-to-hub communication is the default baseline behavior before any NHRP resolution occurs; the purpose of an NHRP resolution request is specifically to move traffic off the hub path and onto a direct spoke-to-spoke tunnel.

Concept tested: FlexVPN NHRP resolution for spoke-to-spoke direct tunnels

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnflexvpn/configuration/xe-16/sec-conn-vpnflexvpn-xe-16-book/sec-conn-flexvpn-spoke-spoke.html

Topics

#FlexVPN#NHRP resolution#spoke-to-spoke#dynamic tunnels

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-730 Practice