nerdexam
Cisco

352-001 · Question #618

A company requires to connect two data center sites using a hub-and-spoke design. There are 2000 remote sites. It is required to transfer MPLS labeled packets over the public Internet using one…

The correct answer is B. DMVPN dynamically builds GRE tunnels with MPLS encapsulation inside. DMVPN is the correct solution because its multipoint GRE tunnels natively encapsulate MPLS labeled packets inside IP, while its dynamic NHRP-based spoke registration scales a hub-and-spoke design to thousands of sites with minimal hub configuration.

Designing Network Services

Question

A company requires to connect two data center sites using a hub-and-spoke design. There are 2000 remote sites. It is required to transfer MPLS labeled packets over the public Internet using one router at each remote site. These MPLS labeled packets must be encapsulated inside IP packets. Which solution must be used to simplify this network design?

Options

  • AGET VPN encrypts the MPLS packets with IPsec.
  • BDMVPN dynamically builds GRE tunnels with MPLS encapsulation inside.
  • CSite-to-site IPsec without GRE encapsulates the MPLS packets.
  • DPPPoE encapsulates the MPLS packets
  • EL2TPv3 encapsulated the MPLS packets

How the community answered

(23 responses)
  • A
    9% (2)
  • B
    70% (16)
  • C
    17% (4)
  • D
    4% (1)

Why each option

DMVPN is the correct solution because its multipoint GRE tunnels natively encapsulate MPLS labeled packets inside IP, while its dynamic NHRP-based spoke registration scales a hub-and-spoke design to thousands of sites with minimal hub configuration.

AGET VPN encrypts the MPLS packets with IPsec.

GET VPN is a tunnel-less group encryption solution designed for trusted MPLS core networks - it preserves the original IP header for routing purposes and does not encapsulate MPLS labeled packets inside new IP headers for transport over the public Internet.

BDMVPN dynamically builds GRE tunnels with MPLS encapsulation inside.Correct

DMVPN uses multipoint GRE (mGRE) which supports MPLS label encapsulation inside IP, directly satisfying the requirement to carry labeled packets over the public Internet. The NHRP-based dynamic spoke registration in DMVPN means each of the 2000 remote sites registers automatically with the hub, eliminating the need for a static crypto map or tunnel interface per spoke and greatly simplifying the hub router configuration.

CSite-to-site IPsec without GRE encapsulates the MPLS packets.

Standard site-to-site IPsec in tunnel mode encapsulates IP packets but cannot directly carry MPLS labeled packets without an underlying GRE or similar encapsulation layer, making it insufficient on its own for this requirement.

DPPPoE encapsulates the MPLS packets

PPPoE is a Layer 2 broadband access encapsulation protocol operating between a CPE and an access concentrator - it does not provide routed IP tunneling or MPLS label transport suitable for Internet-based hub-and-spoke WAN designs.

EL2TPv3 encapsulated the MPLS packets

L2TPv3 is designed for Layer 2 pseudowire emulation between fixed endpoints and lacks the dynamic spoke registration and NHRP-based scalability needed to simplify a 2000-site hub-and-spoke deployment.

Concept tested: DMVPN mGRE tunneling for scalable MPLS transport over Internet

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/xe-16/sec-conn-dmvpn-xe-16-book/sec-conn-dmvpn.html

Topics

#DMVPN#GRE#MPLS over Internet#hub-and-spoke VPN

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 352-001 Practice