As shown in the figure, IPSec tunnels are established between the headquarters and branches. To achieve IPSec traffic load sharing, at least how many IPSec tunnels need to be established?

Question

Exhibit

Options

• A1
• B2
• C4
• D3

• A
  5% (2)
• B
  8% (3)
• C
  84% (31)
• D
  3% (1)

Explanation

Option C (4 tunnels) is correct because IPSec load sharing requires at least two parallel tunnels per connection path to distribute traffic. In the typical exam topology - one HQ with two WAN uplinks connecting to two branch offices - each branch must establish a tunnel to each HQ uplink, yielding 2 branches × 2 tunnels = 4 tunnels minimum to enable genuine traffic load balancing across all paths.

Why the distractors fail:

• A (1 tunnel): A single tunnel is a single path - by definition, load sharing is impossible with only one tunnel.
• B (2 tunnels): Two tunnels only covers load sharing for one branch-to-HQ path pair; the second branch remains without a redundant path.
• D (3 tunnels): Three tunnels creates an asymmetric topology that cannot evenly distribute load across a dual-uplink, dual-branch design.

Memory tip: Think "2×2 = 4." For load sharing, you need a minimum of 2 tunnels per site (one per HQ uplink), and with 2 branch sites, that multiplies to 4. Whenever you see a dual-uplink HQ with two branches on an exam, the load-sharing tunnel count is always at least 4.

No community discussion yet for this question.