352-001 · Question #483
You are designing a GET VPN solution for an existing branch network. The existing network has the following characteristics: 50 remote sites (with an additional 30 remote sites expected over the next
The correct answer is E. No additional protocol is necessary. GET VPN is a tunnel-less encryption solution that preserves original IP headers, so the existing MPLS L3 VPN underlay and OSPF between PE and CE routers provide all required routing and no overlay protocol is needed.
Question
You are designing a GET VPN solution for an existing branch network. The existing network has the following characteristics: 50 remote sites (with an additional 30 remote sites expected over the next 3 years), Connectivity between all sites is via MPLS Layer 3 VPN service from a single provider, OSPF is the routing protocol used between provider edge and customer edge routers, The customer edge routers will become group members performing the encryption between sites. Which additional routing protocol, if any, should you use for the overlay routing between the group members?
Options
- AEIGRP
- BOSPF (with a different process ID)
- CeBGP
- DRIPv2
- ENo additional protocol is necessary
How the community answered
(49 responses)- A4% (2)
- B10% (5)
- C2% (1)
- D2% (1)
- E82% (40)
Why each option
GET VPN is a tunnel-less encryption solution that preserves original IP headers, so the existing MPLS L3 VPN underlay and OSPF between PE and CE routers provide all required routing and no overlay protocol is needed.
EIGRP would create a redundant overlay routing plane that serves no purpose because GET VPN's tunnel-less design leaves the original IP headers intact and the existing underlay routing already provides full site-to-site reachability.
A second OSPF process would introduce unnecessary routing complexity since GET VPN does not alter IP headers, and the existing OSPF process already establishes reachability between all group members via the MPLS L3 VPN.
eBGP is not required because GET VPN group members do not form a separate routed overlay network; there are no tunnel endpoints between which new BGP adjacencies would need to be established.
RIPv2 would add slow convergence and unnecessary routing overhead when the existing OSPF and MPLS L3 VPN infrastructure already provides all the reachability that GET VPN group members require.
GET VPN uses the Group Domain of Interpretation (GDOI) protocol and encrypts packets in-place while preserving the original source and destination IP addresses - it does not encapsulate traffic in a new tunnel header as DMVPN or IPsec tunnel mode would. Because the routable IP headers are unchanged, all path selection continues to be handled by the existing OSPF process and MPLS L3 VPN infrastructure, making any additional overlay routing protocol redundant and unnecessary.
Concept tested: GET VPN tunnel-less design and routing requirements
Source: https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/GET_VPN/GET_VPN_DIG.html
Topics
Community Discussion
No community discussion yet for this question.