nerdexam
Cisco

352-001 · Question #58

A company wants to connect two data center sites using a hub-and-spoke design with 2000 remote sites. One design consideration is the requirement to transfer MPLS packets over the public Internet…

The correct answer is B. DMVPN can be used to build up GRE tunnels dynamically with MPLS encapsulation inside. DMVPN is the correct solution because its GRE tunnels dynamically encapsulate MPLS packets inside IP headers, enabling transport over a public Internet that does not forward native MPLS.

Network Virtualization

Question

A company wants to connect two data center sites using a hub-and-spoke design with 2000 remote sites. One design consideration is the requirement to transfer MPLS packets over the public Internet. In addition, one router at each site should be used, and the MPLS packets must be encapsulated inside IP packets because the public Internet cannot transfer native MPLS packets. Which feature can be used to simplify the network design?

Options

  • AGET VPN can be used to encrypt the MPLS packets with IPsec.
  • BDMVPN can be used to build up GRE tunnels dynamically with MPLS encapsulation inside.
  • CL2TPv3 can be used to encapsulate the MPLS packets.
  • DSite-to-site IPsec without GRE can be used to encapsulate the MPLS packets.
  • EPPPoE can be used to encapsulate the MPLS packets.

How the community answered

(36 responses)
  • A
    3% (1)
  • B
    78% (28)
  • C
    11% (4)
  • D
    3% (1)
  • E
    6% (2)

Why each option

DMVPN is the correct solution because its GRE tunnels dynamically encapsulate MPLS packets inside IP headers, enabling transport over a public Internet that does not forward native MPLS.

AGET VPN can be used to encrypt the MPLS packets with IPsec.

GET VPN is a tunnel-less solution that encrypts traffic without adding a new encapsulating IP header, so it cannot wrap MPLS packets inside IP for transport over the public Internet.

BDMVPN can be used to build up GRE tunnels dynamically with MPLS encapsulation inside.Correct

DMVPN uses NHRP and GRE to dynamically build hub-to-spoke tunnels, and GRE supports encapsulation of any Layer 3 payload including MPLS packets. This wraps MPLS frames inside IP/GRE headers so they can traverse the public Internet. The dynamic tunnel creation also simplifies management across 2000 sites compared to static individually provisioned tunnels.

CL2TPv3 can be used to encapsulate the MPLS packets.

L2TPv3 is used to extend Layer 2 segments across an IP network for L2VPN services and is not designed to encapsulate MPLS packets in a hub-and-spoke IP WAN architecture at this scale.

DSite-to-site IPsec without GRE can be used to encapsulate the MPLS packets.

IPsec without GRE can only encrypt IP unicast packets and cannot directly encapsulate MPLS payloads; it also requires individually configured static tunnels that do not scale dynamically to 2000 sites.

EPPPoE can be used to encapsulate the MPLS packets.

PPPoE is a Layer 2 access protocol used for broadband subscriber session establishment and has no capability to encapsulate MPLS packets for transport across an IP WAN.

Concept tested: DMVPN GRE tunnels for MPLS encapsulation over IP WAN

Source: https://www.cisco.com/c/en/us/support/docs/security/dynamic-multipoint-vpn-dmvpn/111976-dmvpn-config-00.html

Topics

#DMVPN#GRE tunnels#MPLS over Internet#hub-and-spoke VPN

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 352-001 Practice