300-410 VPN Technologies — 15 Questions

Question 1

A network engineer is configuring a GRE tunnel between two Cisco IOS routers, R1 and R2, to carry OSPF traffic over an ISP network. The tunnel source on R1 is GigabitEthernet0/0 (IP 203.0.113.1), and the tunnel destination is R2's GigabitEthernet0/0 (IP 203.0.113.2). The engineer enters the following commands on R1:

interface Tunnel0
 ip address 10.0.0.1 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 203.0.113.2
 tunnel mode gre ip

After configuration, the tunnel interface is up/up, but OSPF adjacency does not form. What is the most likely cause?

Accepted Answer

The OSPF network type on the tunnel interface is not compatible with the neighbor.. The tunnel is up/up, indicating the underlay and GRE encapsulation are working. OSPF adjacency failure over a GRE tunnel commonly results from mismatched OSPF network types, which change hello/dead timers and neighbor discovery behavior. Aligning the network type on both tunnel interfaces restores adjacency. Other options are either contradicted by the up/up state or unsupported by the scenario.

Answer

The tunnel IP addresses are in different subnets.

Answer

The tunnel interface is configured as passive under OSPF.

Answer

The tunnel destination IP address is not reachable via the underlay network.

Question 2

A network engineer is deploying a DMVPN Phase 3 hub-and-spoke topology. Spokes must be able to communicate directly with each other without traffic traversing the hub. The hub router is configured with 'ip nhrp redirect' and spokes with 'ip nhrp shortcut'. After configuration, spoke-to-spoke traffic still goes through the hub. Which action resolves this issue?

Accepted Answer

Ensure that the hub is configured with 'ip nhrp redirect' and spokes with 'ip nhrp shortcut'.. DMVPN Phase 3 enables spoke-to-spoke direct tunnels by using NHRP redirect on the hub and NHRP shortcut on spokes. The hub sends a redirect message when it receives a packet from a spoke destined to another spoke, allowing the source spoke to dynamically resolve the destination NBMA address and establish a direct tunnel. Without these commands, traffic follows the hub-and-spoke path.

Answer

Add 'ip nhrp map' entries for all remote spokes on each spoke.

Answer

Configure 'ip nhrp network-id' to match on all routers.

Answer

Enable 'ip nhrp map multicast dynamic' on the hub.

Question 3

A network engineer is configuring a VRF-lite based MPLS VPN on a Cisco IOS router. The router has two VRFs: CUSTOMER_A and CUSTOMER_B. The engineer wants to ensure that traffic from CUSTOMER_A can reach the global routing table for management purposes, but CUSTOMER_B should remain isolated. Which configuration accomplishes this?

Accepted Answer

Configure route leaking from CUSTOMER_A to the global routing table using a static route with the global keyword.. To allow a VRF to access the global routing table, you can configure a static route within the VRF that points to a next-hop in the global table using the global keyword. This effectively leaks the route from the VRF to the global table, enabling return traffic. Alternatively, you can use BGP import/export between the VRF and global. The key is to provide a route from the VRF to the global next-hop, while not affecting other VRFs.

Answer

Configure BGP with the default-originate command in the global routing table.

Answer

Configure route leaking from the global routing table to CUSTOMER_A using a static route with the global keyword.

Answer

Configure a default route in CUSTOMER_B pointing to the global routing table.

Question 4

A network administrator is deploying a site-to-site VPN using Cisco IOS GET VPN (Group Encrypted Transport VPN). The company requires that all routers in the group use the same encryption keys and that key distribution be handled by a central server. Which component is responsible for distributing the group security policy and keys to the group members?

Accepted Answer

Key Server (KS). GET VPN uses a centralized Key Server to manage and distribute the group security policy, including encryption keys, to all Group Members. The KS uses the GDOI protocol to authenticate GMs and push the policy. This design eliminates the need for point-to-point IPsec tunnels and allows any-to-any connectivity within the group while maintaining a single encryption policy.

Answer

Group Member (GM)

Answer

Group Domain of Interpretation (GDOI) server

Answer

Certificate Authority (CA)

Question 5

A company uses DMVPN Phase 2 with EIGRP as the routing protocol. The hub is configured with a single mGRE tunnel interface. Spokes are configured with ip nhrp map multicast dynamic and ip nhrp registration no-unique. The network engineer notices that spoke-to-spoke tunnels are not forming even though the hub is reachable. Which configuration change on the spokes is required to enable spoke-to-spoke tunnels in Phase 2?

Accepted Answer

Configure the tunnel interfaces as multipoint GRE with the same subnet as the hub.. In DMVPN Phase 2, spoke-to-spoke tunnels are established when spokes have routes to each other's tunnel IPs and can resolve their NBMA addresses via NHRP. For this to work, all tunnel interfaces must be multipoint GRE and share the same IP subnet. This allows a spoke to send traffic directly to another spoke's tunnel IP, triggering NHRP resolution and direct tunnel creation.

Answer

Configure the spokes with ip nhrp redirect.

Answer

Enable split horizon on the hub's tunnel interface.

Answer

Set the hub as the NHRP next hop server and configure the spokes as clients.

Question 6

A network engineer is deploying DMVPN Phase 2 with IPsec protection. The hub is configured with a point-to-multipoint GRE interface and NHRP. The engineer wants to ensure that spoke-to-spoke traffic is encrypted and that spokes can dynamically establish direct tunnels. Which two configurations are required on the spokes to achieve this? (Choose two.)

Accepted Answer

ip nhrp shortcut. In DMVPN Phase 2, spoke-to-spoke communication requires two key configurations on the spokes: ip nhrp shortcut to allow the spoke to create direct tunnels upon receiving an NHRP redirect, and tunnel protection ipsec profile to encrypt the GRE tunnel, ensuring that spoke-to-spoke traffic is protected. The hub must have ip nhrp redirect and the same IPsec profile. Together, these enable dynamic direct tunnels with encryption.

Answer

ip nhrp redirect

Answer

ip nhrp network-id <id>

Answer

ip nhrp map multicast dynamic

Question 7

A network engineer is configuring a VRF-aware IPsec tunnel on a Cisco IOS router. The router has two VRFs: VRF-A and VRF-B. The engineer wants traffic from VRF-A to be encrypted and sent over a tunnel to a remote peer, while VRF-B traffic should remain unencrypted and use a different path. Which configuration step is required to map the IPsec tunnel to VRF-A?

Accepted Answer

Configure the crypto map with 'set vrf VRF-A' and apply it to the tunnel interface.. To map an IPsec tunnel to a specific VRF, the crypto map must include the 'set vrf' command specifying the VRF name. This tells the router to use that VRF's routing table for encrypted traffic and to only encrypt traffic from that VRF. Applying the crypto map to the appropriate interface then enforces the policy.

Answer

Create a crypto ACL that matches VRF-A traffic and apply it to the physical interface with 'crypto map'.

Answer

Use 'ip vrf forwarding VRF-A' on the tunnel interface and apply the crypto map to the physical interface.

Answer

Apply the crypto map to the tunnel interface and specify 'vrf forwarding VRF-A' under the crypto map.

Question 8

A network administrator is configuring a VRF-aware IPSec VPN on a Cisco IOS router. The router must support overlapping IP addresses for two different customers. The administrator has created VRF CUST-A and VRF CUST-B. Which configuration is required to enable IPSec to operate within a VRF?

Accepted Answer

Configure the crypto map with the set vrf command and apply it to the physical interface.. VRF-aware IPSec allows a single router to support multiple IPSec VPNs with overlapping IP addresses by associating each IPSec tunnel with a VRF. This is achieved by configuring the set vrf command in the crypto map and applying the crypto map to the physical interface. The set vrf command ensures that IKE and IPSec packets use the correct VRF routing table.

Answer

Use a separate crypto keyring for each VRF and bind it to the crypto map.

Answer

Apply the crypto map to the VRF interface and specify the VRF under the crypto map.

Answer

Enable VRF-aware IPSec globally with the crypto vrf command.

Question 9

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology using mGRE and NHRP on Cisco IOS routers. The hub router is configured with `ip nhrp map multicast dynamic` and `ip nhrp network-id 100`. Spoke routers register successfully, and the hub can ping all spoke tunnel IPs. However, when a spoke tries to reach another spoke's LAN subnet, the packet is dropped at the hub. Which configuration on the hub is most likely missing to allow spoke-to-spoke traffic?

Accepted Answer

ip nhrp redirect. In DMVPN Phase 3, the hub must be configured with `ip nhrp redirect` to inform spokes of a better direct path when they attempt to communicate with each other. Spokes also require `ip nhrp shortcut` to act on the redirect. The scenario indicates the hub is missing a command, and without redirect, the hub cannot signal the spoke to build a direct tunnel, causing spoke-to-spoke traffic to fail or hairpin inefficiently.

Answer

ip nhrp shortcut

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp network-id 100

Question 10

A network administrator is troubleshooting a DMVPN Phase 3 configuration on a Cisco IOS router. The hub router is configured with `ip nhrp redirect`, and spoke routers are configured with `ip nhrp shortcut`. However, spoke-to-spoke communication is failing; packets are being dropped or taking a suboptimal path through the hub. Which two actions should the administrator take to resolve the issue? (Choose two.)

Accepted Answer

Ensure that the spoke routers have a route to the destination spoke's tunnel IP address via the hub or through NHRP.. DMVPN Phase 3 requires `ip nhrp redirect` on the hub and `ip nhrp shortcut` on spokes to enable direct spoke-to-spoke tunnels. Additionally, spokes must have a route to the destination spoke's tunnel IP or subnet via the tunnel interface, often learned through routing protocols. Without these, spoke-to-spoke traffic may fail or be suboptimal. The other options are either irrelevant or would cause broader failures if misconfigured.

Answer

Verify that the hub router has `ip nhrp map multicast dynamic` configured on its tunnel interface.

Answer

Verify that the spoke routers have `ip nhrp map multicast dynamic` configured on their tunnel interfaces.

Answer

Check that the tunnel interface on the hub is configured with `ip nhrp network-id` matching the spokes.

Question 11

A network engineer is implementing DMVPN Phase 2 with EIGRP as the routing protocol. To ensure proper spoke-to-spoke communication, the engineer must configure the hub and spokes correctly. Which two statements about DMVPN Phase 2 with EIGRP are true? (Choose two.)

Accepted Answer

The hub must be configured with ip nhrp map multicast dynamic to forward EIGRP multicast to all spokes.. In DMVPN Phase 2 with EIGRP, the hub must have ip nhrp map multicast dynamic to replicate multicast EIGRP hellos to all spokes. Each spoke must have a static NHRP mapping for the hub's tunnel IP to its NBMA address to establish the initial tunnel and send NHRP registrations. These two configurations are essential for forming EIGRP adjacencies and enabling spoke-to-spoke tunnels through NHRP resolution.

Answer

Spokes must have ip nhrp shortcut configured to enable direct spoke-to-spoke tunnels.

Answer

The hub must be configured with ip nhrp redirect to allow spokes to establish direct tunnels.

Answer

Spokes must have ip nhrp map multicast dynamic configured to receive EIGRP multicast updates.

Question 12

A network administrator is troubleshooting a DMVPN Phase 2 network where spoke-to-spoke communication fails. The hub is a Cisco IOS router, and spokes are configured with NHRP. The administrator notices that the hub has a route to the spokes' tunnel networks, but spokes do not have routes to each other's tunnel networks. Which configuration change on the hub is required to allow spokes to dynamically learn routes to other spokes?

Accepted Answer

Disable next-hop-self on the hub for routes learned from spokes.. In DMVPN Phase 2, spoke-to-spoke communication requires that spokes receive routes to other spokes with the correct next-hop address (the destination spoke's tunnel IP). The hub must not change the next hop to itself. Disabling next-hop-self on the hub for routes learned from spokes ensures that spokes can resolve the destination spoke via NHRP and build direct tunnels.

Answer

Enable NHRP redirect on the hub.

Answer

Configure the hub's tunnel interface as a point-to-multipoint network type for OSPF.

Answer

Disable split horizon on the hub's physical interface.

Question 13

A network administrator is troubleshooting an IPsec VPN tunnel between two Cisco IOS routers that uses IKEv2. Phase 1 is up, but Phase 2 fails to establish. The administrator suspects a mismatch in the IPsec proposal parameters. Which two parameters must match on both peers for the IPsec SA to be established? (Choose two.)

Accepted Answer

Hash algorithm. For IPsec Phase 2, the encryption and hash algorithms in the IPsec proposal must match on both peers. Other parameters like DH group (unless PFS is used), authentication method, and IKE version are part of Phase 1 and are not renegotiated in Phase 2.

Answer

DH group

Answer

IKE version

Answer

Authentication method

Question 14

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology using mGRE on the hub and a single physical interface on each spoke. The engineer wants spokes to communicate directly with each other without traffic transiting the hub, and requires that spoke-to-spoke tunnels are dynamically created only when needed. Which NHRP configuration on the hub is required to support this requirement?

Accepted Answer

Enable NHRP redirect on the hub and NHRP shortcut on the spokes.. For DMVPN Phase 3, the hub uses NHRP redirect to notify the originating spoke that a more optimal path exists. The spoke must have NHRP shortcut enabled to act on that redirect and build a direct tunnel to the target spoke. This design eliminates the need for traffic to traverse the hub for spoke-to-spoke flows, while still using the hub for initial resolution.

Answer

Enable NHRP redirect and NHRP shortcut on the hub tunnel interface.

Answer

Enable NHRP shortcut on the hub tunnel interface.

Answer

Enable NHRP redirect on the hub tunnel interface.

Question 15

A network engineer is troubleshooting an MPLS Layer 3 VPN. The service provider uses MP-BGP with VPNv4 address family. The engineer notices that the PE router is not receiving routes from a remote PE for a particular VRF. Which two statements are true regarding the operation of MP-BGP in this environment? (Choose two.)

Accepted Answer

The PE router must have a unique route distinguisher (RD) for each VRF to ensure that routes from different VRFs are kept separate.. In MPLS Layer 3 VPN, MP-BGP uses route distinguishers (RDs) to create unique VPNv4 prefixes and route targets (RTs) to control import and export of routes between VRFs. A unique RD per VRF ensures separation of overlapping addresses, while the export RT attached to routes allows remote PEs to import them into the correct VRF based on matching import RTs.

Answer

The PE router must use a separate BGP session for each VRF to exchange VPNv4 routes.

Answer

The PE router must configure a route target (RT) import on the VRF to control which routes are accepted from other PE routers.

Answer

The PE router must enable the VPNv4 address family under the BGP routing process to exchange VPNv4 routes.