352-001 · Question #197
You are designing a multisite VPN solution for a customer and you are concerned with the additional overhead of point-to-point tunnels and the associated overlay routing with DMVPN. How does a…
The correct answer is B. In a GDOI-based VPN, all group members share a common security association. GDOI-based GET VPN eliminates point-to-point tunnel and overlay routing overhead by distributing a single shared group Security Association to all members via a Key Server.
Question
You are designing a multisite VPN solution for a customer and you are concerned with the additional overhead of point-to-point tunnels and the associated overlay routing with DMVPN. How does a GDOI-based VPN eliminate the additional tunnel and routing overhead found in DMVPN?
Options
- AThe GDOI-based VPN requires overlaying a secondary routing infrastructure through the tunnels.
- BIn a GDOI-based VPN, all group members share a common security association.
- CThe GDOI-based VPN requires the provisioning of a complex connectivity mesh.
- DThe GDOI-based VPN leverages the routing protocol to find its peer for tunnel setup.
How the community answered
(52 responses)- A4% (2)
- B81% (42)
- C6% (3)
- D10% (5)
Why each option
GDOI-based GET VPN eliminates point-to-point tunnel and overlay routing overhead by distributing a single shared group Security Association to all members via a Key Server.
GET VPN explicitly preserves the original IP header and relies on the underlay routing infrastructure, so it does not overlay a secondary routing infrastructure through tunnels.
In a GDOI-based GET VPN, a Key Server pushes a common group TEK (Traffic Encryption Key) and KEK (Key Encryption Key) to all registered group members, so every member encrypts and decrypts traffic using the same Security Association without establishing individual IPsec tunnels. Because GET VPN uses tunnel-less transport that preserves the original IP header, the existing underlay routing infrastructure forwards packets natively and no overlay routing protocol is required, directly removing both the tunnel provisioning and the associated routing overhead present in DMVPN.
The group SA model means each member only registers with the Key Server to receive shared keys, eliminating the need to provision a complex point-to-point connectivity mesh.
GDOI uses a Key Server registration and key-push model to distribute group keying material - it does not use a routing protocol to discover peers or set up tunnels.
Concept tested: GDOI GET VPN shared group Security Association and tunnel-less design
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_getvpn/configuration/xe-16/sec-get-vpn-xe-16-book/sec-get-vpn.html
Topics
Community Discussion
No community discussion yet for this question.