nerdexam
Cisco

352-001 · Question #57

You are working on a network design plan for a company with approximately 2000 sites. The sites will be connected using the public Internet. You plan to use private IP addressing in the network…

The correct answer is D. DMVPN must be used, because private IP addresses cannot be transferred with GET VPN through. DMVPN must be used because GET VPN is tunnel-less and preserves original private IP headers, which the public Internet cannot route.

Designing Security

Question

You are working on a network design plan for a company with approximately 2000 sites. The sites will be connected using the public Internet. You plan to use private IP addressing in the network design, which will be routed without NAT through an encrypted WAN network. Some sites will be connected to the Internet with dynamic public IP addresses, and these addresses may change occasionally. Which VPN solution will support these design requirements?

Options

  • AGET VPN must be used, because DMVPN does not scale to 2000 sites.
  • BDMVPN must be used, because GET VPN does not scale to 2000 sites.
  • CGET VPN must be used, because private IP addresses cannot be transferred with DMVPN through
  • DDMVPN must be used, because private IP addresses cannot be transferred with GET VPN through
  • EGET VPN must be used, because DMVPN does not support dynamic IP addresses for some sites.
  • FDMVPN must be used, because GET VPN does not support dynamic IP addresses for some sites.

How the community answered

(24 responses)
  • A
    4% (1)
  • B
    4% (1)
  • D
    83% (20)
  • E
    8% (2)

Why each option

DMVPN must be used because GET VPN is tunnel-less and preserves original private IP headers, which the public Internet cannot route.

AGET VPN must be used, because DMVPN does not scale to 2000 sites.

Both GET VPN and DMVPN can scale well beyond 2000 sites; the claim that DMVPN cannot scale to this size is factually incorrect.

BDMVPN must be used, because GET VPN does not scale to 2000 sites.

DMVPN is the correct choice, but not because of any scaling limitation - both technologies are capable of scaling to 2000 or more sites.

CGET VPN must be used, because private IP addresses cannot be transferred with DMVPN through

DMVPN can transfer private IP addresses over the public Internet because GRE tunnels encapsulate private IP packets inside a new IP header that uses public addresses for transport.

DDMVPN must be used, because private IP addresses cannot be transferred with GET VPN throughCorrect

GET VPN is a tunnel-less VPN technology that preserves the original IP header of each packet, meaning private RFC 1918 source and destination addresses remain visible in the outer header. The public Internet cannot route these private addresses, making GET VPN architecturally incompatible with this design. DMVPN uses GRE tunnels with public IP outer headers to encapsulate private IP packets, allowing them to traverse the public Internet without requiring NAT.

EGET VPN must be used, because DMVPN does not support dynamic IP addresses for some sites.

DMVPN is specifically designed to support spokes with dynamic public IP addresses via NHRP spoke registration, so the claim that DMVPN does not support dynamic IPs is factually incorrect.

FDMVPN must be used, because GET VPN does not support dynamic IP addresses for some sites.

DMVPN is the correct choice, but the reason is incomplete - GET VPN group members can initiate GDOI registration to a statically addressed Key Server regardless of spoke IP dynamism; the real constraint is GET VPN's tunnel-less architecture being incompatible with private IP routing over the public Internet.

Concept tested: GET VPN vs DMVPN private IP routing over public Internet

Source: https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/WAN_and_MAN/DMVPN/DMVPN_2.html

Topics

#DMVPN#GETVPN#dynamic IP addresses#VPN scalability

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 352-001 Practice