352-001 · Question #351
What are two design characteristics of GETVPN? (Choose two.)
The correct answer is A. It uses GDOI to distribute keys. D. It uses tunnel-less technology.. GETVPN uses GDOI for group key distribution and operates without creating tunnels, preserving the original IP header. These two characteristics distinguish it from traditional tunnel-based VPN technologies.
Question
What are two design characteristics of GETVPN? (Choose two.)
Options
- AIt uses GDOI to distribute keys.
- BIt supports private addresses over public Internet.
- CIt requires multicast replication at the hub.
- DIt uses tunnel-less technology.
- EIt supports dynamic partial- or full-mesh tunnels.
How the community answered
(42 responses)- A90% (38)
- B5% (2)
- C2% (1)
- E2% (1)
Why each option
GETVPN uses GDOI for group key distribution and operates without creating tunnels, preserving the original IP header. These two characteristics distinguish it from traditional tunnel-based VPN technologies.
GETVPN uses the Group Domain of Interpretation (GDOI) protocol to register group members with a Key Server and securely distribute the group encryption keys (TEK and KEK) to all registered group members.
GETVPN preserves the original IP header and therefore requires all endpoints to have routable addresses, making it unsuitable for use over the public Internet with private RFC 1918 addressing.
GETVPN uses a Key Server model rather than a hub-and-spoke tunnel model, so it does not require multicast replication at a hub - traffic flows directly between group members.
GETVPN is tunnel-less because it encrypts the payload while preserving the original source and destination IP headers, allowing packets to be routed natively across the network without encapsulation overhead.
GETVPN is a tunnel-less technology that does not create any tunnels, so the concept of partial- or full-mesh tunnels does not apply to it.
Concept tested: GETVPN key management and tunnel-less VPN architecture
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_getvpn/configuration/xe-16/sec-conn-getvpn-xe-16-book/sec-conn-getvpn.html
Topics
Community Discussion
No community discussion yet for this question.