nerdexam
Cisco

300-730 · Question #22

Refer to the exhibit: Interface: Tunnel1 Crypto map tag: Tunnel-head-0, local addr 192.168.0.1 protected vrf: (none) local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0) remote ident (addr/mask/prot

The correct answer is B. DMVPN. The exhibit shows 'show crypto ipsec sa' output with a crypto map tag named 'Tunnel-head-0', a naming convention characteristic of DMVPN hub (head-end) configurations.

Site-to-site VPNs on Routers and Firewalls

Question

Refer to the exhibit: Interface: Tunnel1 Crypto map tag: Tunnel-head-0, local addr 192.168.0.1 protected vrf: (none) local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0) remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0) current_peer 192.168.0.2, port 500 PERMIT, flags={origin:static} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts decompress failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 local crypto endpt.: 192.168.0.1, remote crypto endpt.: 192.168.0.2 plaintext mtu 1500, nss mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet1 current outbound spi: 0x3DD5B003(1023791071) PFS (Y/N): N, DH group: none Which two tunnel types produce the show crypto ipsec sa output seen in the exhibit? (Choose two.)

Options

  • Acrypto map tag
  • BDMVPN
  • CGRE
  • DFlexVPN
  • EVTI

How the community answered

(25 responses)
  • A
    4% (1)
  • B
    80% (20)
  • C
    4% (1)
  • E
    12% (3)

Why each option

The exhibit shows 'show crypto ipsec sa' output with a crypto map tag named 'Tunnel-head-0', a naming convention characteristic of DMVPN hub (head-end) configurations.

Acrypto map tag

Crypto map tag is a configuration element label that can be applied to any IPsec policy, not a VPN technology type that can be inferred from the output alone.

BDMVPNCorrect

DMVPN hubs use a crypto map tag containing 'head' in the name (e.g., 'Tunnel-head-0') as part of the standard hub configuration for multipoint GRE over IPsec with NHRP. The combination of a tunnel interface, wildcard proxy identities (0.0.0.0/0.0.0.0), and this characteristic 'head' crypto map naming confirms a DMVPN deployment. Other VPN technologies use entirely different configuration structures and naming conventions.

CGRE

GRE is a tunneling protocol used as the underlying transport within DMVPN, but standalone GRE tunnels do not produce a 'Tunnel-head' crypto map naming convention.

DFlexVPN

FlexVPN uses IKEv2 with virtual tunnel interfaces and a fundamentally different configuration model that does not produce crypto map tags with the 'head' identifier.

EVTI

VTI creates static point-to-point IPsec tunnels with a different crypto map structure and naming scheme, and does not use the 'Tunnel-head' naming pattern.

Concept tested: DMVPN hub crypto map naming identification

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/xe-16/sec-conn-dmvpn-xe-16-book.html

Topics

#DMVPN#crypto map#tunnel identification#NHRP

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-730 Practice