NSE4 · Question #305
You are tasked to architect a new IPsec deployment with the following criteria: - There are two HQ sites that all satellite offices must connect to. - The satellite offices do not need to…
The correct answer is B. Hub-and-spoke. A hub-and-spoke IPsec topology is ideal when satellite offices need to connect to central HQ sites but not communicate directly with each other, while minimizing tunnel configuration.
Question
You are tasked to architect a new IPsec deployment with the following criteria:
- There are two HQ sites that all satellite offices must connect to.
- The satellite offices do not need to communicate directly with other
satellite offices.
- No dynamic routing will be used.
- The design should minimize the number of tunnels being configured.
Which topology should be used to satisfy all of the requirements?
Options
- ARedundant
- BHub-and-spoke
- CPartial mesh
- DFully meshed
How the community answered
(46 responses)- A2% (1)
- B80% (37)
- C7% (3)
- D11% (5)
Why each option
A hub-and-spoke IPsec topology is ideal when satellite offices need to connect to central HQ sites but not communicate directly with each other, while minimizing tunnel configuration.
Redundant is a characteristic of a design (e.g., redundant links or hubs) rather than a primary network topology that defines how all sites connect and communicate.
A hub-and-spoke topology allows all satellite offices (spokes) to connect to central HQ sites (hubs) without requiring direct connections between spokes, thereby satisfying the requirement for no direct satellite-to-satellite communication and minimizing tunnel count.
A partial mesh topology would involve some satellite offices connecting directly to each other, violating the requirement that satellite offices do not need to communicate with one another.
A fully meshed topology would require every site to have a tunnel to every other site, resulting in a significantly higher number of tunnels and enabling direct satellite-to-satellite communication, which is explicitly not required.
Concept tested: IPsec VPN topology selection (Hub-and-spoke)
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/501308/ipsec-vpn-topologies
Topics
Community Discussion
No community discussion yet for this question.