DRAG DROP Drag and drop the design characteristics of GET VPN from the left to the right. Not all options are used. Answer: A, C, D

Question

Exhibit

Answer Area

Explanation

GET VPN Design Characteristics - Explanation

What is GET VPN?

GET VPN (Group Encrypted Transport VPN) is a Cisco tunnel-less encryption technology designed for use over trusted networks like MPLS or private WANs. It uses a centralized Key Server (KS) to distribute shared keys to Group Members (GMs), and crucially, it preserves the original IP header rather than encapsulating it in a new tunnel header.

Why Each Item Is Placed (or Excluded)

Position 1 - Item A: "It simplifies encryption key management while supporting routing, QoS, and multicast."

Why it's correct:

• GET VPN uses GDOI (Group Domain of Interpretation) with a centralized Key Server that pushes IPsec keys to all group members. You don't manually configure pairwise tunnels - one KS manages keys for the entire group. This is the core management simplification.
• Because GET VPN uses header preservation (the original source/destination IP headers are untouched), the underlying network still sees the real IP addresses. This means routing protocols, QoS DSCP markings, and multicast all work natively - they aren't broken by encapsulation.

Position 2 - Item C: "It supports native multicast across MPLS and private IP networks."

Why it's correct:

• Traditional IPsec encapsulates the entire original packet inside a new IP header, which destroys multicast because multicast destination addresses (224.x.x.x) can't survive encapsulation.
• GET VPN's tunnel-less, header-preserving design means the original multicast destination IP is visible to the network. Multicast replication works naturally over the MPLS/private WAN fabric.

This is a key differentiator from DMVPN or traditional site-to-site IPsec, which require GRE tunnels to carry multicast.

Position 3 - Item D: "It offers scalable, full meshing for IPsec VPNs."

Why it's correct:

• Traditional IPsec requires n*(n-1)/2 tunnels for full mesh (e.g., 100 sites = 4,950 tunnels). GET VPN uses a group Security Association (SA) - all members share the same encryption keys, so any member can decrypt traffic from any other member without a dedicated tunnel. Full mesh connectivity is automatic and scales linearly (just register new GMs with the KS).

Excluded - Item B: "It provides encryption, but not authentication."

Why it's wrong (common misconception):

• GET VPN uses IPsec ESP, which provides both encryption and data-origin authentication/integrity. The claim that GET VPN lacks authentication is false.
• The confusion sometimes arises because GET VPN trusts the underlying network (MPLS/private WAN) for perimeter security and doesn't use public-key infrastructure for peer authentication the same way traditional IPsec IKE does - but the actual traffic is still authenticated via IPsec ESP's integrity check (e.g., HMAC-SHA).

Summary Table

Common Exam Mistakes

1. Confusing GET VPN with DMVPN - DMVPN is also scalable but uses GRE tunnels and supports public internet; GET VPN is tunnel-less and requires a trusted private network.
2. Thinking GET VPN lacks authentication - It does authenticate; Item B is a trap answer.
3. Missing the header preservation concept - This single design choice is what enables routing, QoS, and multicast simultaneously, making Item A's statement accurate.

No community discussion yet for this question.