NSE4 · Question #95
Which IPsec configuration mode can be used for implementing GRE-over-IPsec VPNs?.
The correct answer is B. Route-based only. This question asks which IPsec configuration mode is suitable for implementing GRE-over-IPsec VPNs.
Question
Which IPsec configuration mode can be used for implementing GRE-over-IPsec VPNs?.
Options
- APolicy-based only.
- BRoute-based only.
- CEither policy-based or route-based VPN.
- DGRE-based only.
How the community answered
(17 responses)- A6% (1)
- B88% (15)
- C6% (1)
Why each option
This question asks which IPsec configuration mode is suitable for implementing GRE-over-IPsec VPNs.
Policy-based IPsec operates by matching traffic against policies and does not create a virtual interface, making it unsuitable for encapsulating GRE tunnels.
GRE-over-IPsec VPNs require the creation of a virtual tunnel interface (VTI) for GRE, and then IPsec is applied to protect this GRE tunnel, which necessitates route-based IPsec for its interface-based routing capabilities.
Policy-based VPNs cannot encapsulate GRE, so stating that 'either' mode works is incorrect.
'GRE-based only' is not a recognized IPsec configuration mode; GRE is a separate tunneling protocol that can be protected by IPsec.
Concept tested: IPsec VPN modes for GRE tunnels
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/468846/route-based-vs-policy-based-ipsec-vpn
Topics
Community Discussion
No community discussion yet for this question.