352-011 · Question #18
Refer to the exhibit. A customer interconnected hundreds of branch offices into a single DMVPN network, with the HUB in the main data center. Due to security policies, the customer requires that the…
Looking at this DMVPN security question, the correct answers are A and B. Why A and B are correct together: Placing the WAN interface in a Front Door VRF (FVRF) separates the underlay routing (internet/ISP) from the overlay routing (DMVPN tunnel in the global table). This…
Question
Refer to the exhibit. A customer interconnected hundreds of branch offices into a single DMVPN network, with the HUB in the main data center. Due to security policies, the customer requires that the default route for all Internet traffic from the users at the branches must go through the tunnel and the only connections that are allowed to and from the branch router over the local internet circuit are the DMVPN tunnels. Which two combined actions must you take on the branch router to address these security requirements and keep the solution scalable? (Choose two)
Exhibit
Options
- APlace the WAN interface in a front-door VRF, leaving the tunnel interface in the default routing
- BProtect the WAN interface by an inbound ACL that permits only IPsec-related traffic
- CImplement a zone-based firewall that allows only IPsec-related traffic from zone UNTRUSTED to
- DAdd a host route for the public IP address of each remote branch and HUB routers that points
- EUse a floating default route with the preferred path over the tunnel and a backup path over the
Explanation
Looking at this DMVPN security question, the correct answers are A and B.
Why A and B are correct together: Placing the WAN interface in a Front Door VRF (FVRF) separates the underlay routing (internet/ISP) from the overlay routing (DMVPN tunnel in the global table). This allows a default route in the global table to point traffic through the tunnel, satisfying requirement #1, while remaining scalable across hundreds of branches without manual route management. Pairing this with an inbound ACL on the WAN interface (permitting only UDP 500/IKE, UDP 4500/NAT-T, and ESP/protocol 50) directly enforces requirement #2 - only IPsec-related traffic is permitted on the local internet circuit - and a single ACL template can be deployed identically to all branches.
Why the distractors fail:
- C (Zone-based firewall): Functionally could restrict IPsec traffic, but adds stateful firewall complexity at every branch, harming scalability and increasing overhead without adding benefit over a simple ACL here.
- D (Host routes per spoke/hub): Directly violates the scalability requirement - manually managing hundreds of host routes across hundreds of branches is an operational nightmare and defeats the purpose of DMVPN.
- E (Floating default route): Doesn't address the security constraint at all; a backup path over the raw WAN would allow non-IPsec traffic to exit the branch, violating policy.
Memory tip: Think "VRF locks the door, ACL guards the keyhole." FVRF isolates the underlay so the overlay (tunnel) owns the global default route, and the ACL ensures the WAN interface only speaks IPsec - both are one-time templates that scale to any number of branches.
Topics
Community Discussion
No community discussion yet for this question.