300-410 VPN Technologies — Timed 20 Questions

Question 1

A network engineer is configuring a GRE tunnel between two Cisco IOS routers, R1 and R2, to carry OSPF traffic over an ISP network. The tunnel source on R1 is GigabitEthernet0/0 (IP 203.0.113.1), and the tunnel destination is R2's GigabitEthernet0/0 (IP 203.0.113.2). The engineer enters the following commands on R1:

interface Tunnel0
 ip address 10.0.0.1 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 203.0.113.2
 tunnel mode gre ip

After configuration, the tunnel interface is up/up, but OSPF adjacency does not form. What is the most likely cause?

Accepted Answer

The OSPF network type on the tunnel interface is not compatible with the neighbor.. The tunnel is up/up, indicating the underlay and GRE encapsulation are working. OSPF adjacency failure over a GRE tunnel commonly results from mismatched OSPF network types, which change hello/dead timers and neighbor discovery behavior. Aligning the network type on both tunnel interfaces restores adjacency. Other options are either contradicted by the up/up state or unsupported by the scenario.

Answer

The tunnel IP addresses are in different subnets.

Answer

The tunnel interface is configured as passive under OSPF.

Answer

The tunnel destination IP address is not reachable via the underlay network.

Question 2

A network engineer is deploying a DMVPN Phase 3 hub-and-spoke topology. Spokes must be able to communicate directly with each other without traffic traversing the hub. The hub router is configured with 'ip nhrp redirect' and spokes with 'ip nhrp shortcut'. After configuration, spoke-to-spoke traffic still goes through the hub. Which action resolves this issue?

Accepted Answer

Ensure that the hub is configured with 'ip nhrp redirect' and spokes with 'ip nhrp shortcut'.. DMVPN Phase 3 enables spoke-to-spoke direct tunnels by using NHRP redirect on the hub and NHRP shortcut on spokes. The hub sends a redirect message when it receives a packet from a spoke destined to another spoke, allowing the source spoke to dynamically resolve the destination NBMA address and establish a direct tunnel. Without these commands, traffic follows the hub-and-spoke path.

Answer

Add 'ip nhrp map' entries for all remote spokes on each spoke.

Answer

Configure 'ip nhrp network-id' to match on all routers.

Answer

Enable 'ip nhrp map multicast dynamic' on the hub.

Question 3

A network engineer is configuring a VRF-lite based MPLS VPN on a Cisco IOS router. The router has two VRFs: CUSTOMER_A and CUSTOMER_B. The engineer wants to ensure that traffic from CUSTOMER_A can reach the global routing table for management purposes, but CUSTOMER_B should remain isolated. Which configuration accomplishes this?

Accepted Answer

Configure route leaking from CUSTOMER_A to the global routing table using a static route with the global keyword.. To allow a VRF to access the global routing table, you can configure a static route within the VRF that points to a next-hop in the global table using the global keyword. This effectively leaks the route from the VRF to the global table, enabling return traffic. Alternatively, you can use BGP import/export between the VRF and global. The key is to provide a route from the VRF to the global next-hop, while not affecting other VRFs.

Answer

Configure BGP with the default-originate command in the global routing table.

Answer

Configure route leaking from the global routing table to CUSTOMER_A using a static route with the global keyword.

Answer

Configure a default route in CUSTOMER_B pointing to the global routing table.

Question 4

A network administrator is deploying a site-to-site VPN using Cisco IOS GET VPN (Group Encrypted Transport VPN). The company requires that all routers in the group use the same encryption keys and that key distribution be handled by a central server. Which component is responsible for distributing the group security policy and keys to the group members?

Accepted Answer

Key Server (KS). GET VPN uses a centralized Key Server to manage and distribute the group security policy, including encryption keys, to all Group Members. The KS uses the GDOI protocol to authenticate GMs and push the policy. This design eliminates the need for point-to-point IPsec tunnels and allows any-to-any connectivity within the group while maintaining a single encryption policy.

Answer

Group Member (GM)

Answer

Group Domain of Interpretation (GDOI) server

Answer

Certificate Authority (CA)

Question 5

A company uses DMVPN Phase 2 with EIGRP as the routing protocol. The hub is configured with a single mGRE tunnel interface. Spokes are configured with ip nhrp map multicast dynamic and ip nhrp registration no-unique. The network engineer notices that spoke-to-spoke tunnels are not forming even though the hub is reachable. Which configuration change on the spokes is required to enable spoke-to-spoke tunnels in Phase 2?

Accepted Answer

Configure the tunnel interfaces as multipoint GRE with the same subnet as the hub.. In DMVPN Phase 2, spoke-to-spoke tunnels are established when spokes have routes to each other's tunnel IPs and can resolve their NBMA addresses via NHRP. For this to work, all tunnel interfaces must be multipoint GRE and share the same IP subnet. This allows a spoke to send traffic directly to another spoke's tunnel IP, triggering NHRP resolution and direct tunnel creation.

Answer

Configure the spokes with ip nhrp redirect.

Answer

Enable split horizon on the hub's tunnel interface.

Answer

Set the hub as the NHRP next hop server and configure the spokes as clients.

Question 6

A network engineer is deploying DMVPN Phase 2 with IPsec protection. The hub is configured with a point-to-multipoint GRE interface and NHRP. The engineer wants to ensure that spoke-to-spoke traffic is encrypted and that spokes can dynamically establish direct tunnels. Which two configurations are required on the spokes to achieve this? (Choose two.)

Accepted Answer

ip nhrp shortcut. In DMVPN Phase 2, spoke-to-spoke communication requires two key configurations on the spokes: ip nhrp shortcut to allow the spoke to create direct tunnels upon receiving an NHRP redirect, and tunnel protection ipsec profile to encrypt the GRE tunnel, ensuring that spoke-to-spoke traffic is protected. The hub must have ip nhrp redirect and the same IPsec profile. Together, these enable dynamic direct tunnels with encryption.

Answer

ip nhrp redirect

Answer

ip nhrp network-id <id>

Answer

ip nhrp map multicast dynamic

Question 7

A network engineer is configuring a VRF-aware IPsec tunnel on a Cisco IOS router. The router has two VRFs: VRF-A and VRF-B. The engineer wants traffic from VRF-A to be encrypted and sent over a tunnel to a remote peer, while VRF-B traffic should remain unencrypted and use a different path. Which configuration step is required to map the IPsec tunnel to VRF-A?

Accepted Answer

Configure the crypto map with 'set vrf VRF-A' and apply it to the tunnel interface.. To map an IPsec tunnel to a specific VRF, the crypto map must include the 'set vrf' command specifying the VRF name. This tells the router to use that VRF's routing table for encrypted traffic and to only encrypt traffic from that VRF. Applying the crypto map to the appropriate interface then enforces the policy.

Answer

Create a crypto ACL that matches VRF-A traffic and apply it to the physical interface with 'crypto map'.

Answer

Use 'ip vrf forwarding VRF-A' on the tunnel interface and apply the crypto map to the physical interface.

Answer

Apply the crypto map to the tunnel interface and specify 'vrf forwarding VRF-A' under the crypto map.

Question 8

A network administrator is configuring a VRF-aware IPSec VPN on a Cisco IOS router. The router must support overlapping IP addresses for two different customers. The administrator has created VRF CUST-A and VRF CUST-B. Which configuration is required to enable IPSec to operate within a VRF?

Accepted Answer

Configure the crypto map with the set vrf command and apply it to the physical interface.. VRF-aware IPSec allows a single router to support multiple IPSec VPNs with overlapping IP addresses by associating each IPSec tunnel with a VRF. This is achieved by configuring the set vrf command in the crypto map and applying the crypto map to the physical interface. The set vrf command ensures that IKE and IPSec packets use the correct VRF routing table.

Answer

Use a separate crypto keyring for each VRF and bind it to the crypto map.

Answer

Apply the crypto map to the VRF interface and specify the VRF under the crypto map.

Answer

Enable VRF-aware IPSec globally with the crypto vrf command.

Question 9

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology using mGRE and NHRP on Cisco IOS routers. The hub router is configured with `ip nhrp map multicast dynamic` and `ip nhrp network-id 100`. Spoke routers register successfully, and the hub can ping all spoke tunnel IPs. However, when a spoke tries to reach another spoke's LAN subnet, the packet is dropped at the hub. Which configuration on the hub is most likely missing to allow spoke-to-spoke traffic?

Accepted Answer

ip nhrp redirect. In DMVPN Phase 3, the hub must be configured with `ip nhrp redirect` to inform spokes of a better direct path when they attempt to communicate with each other. Spokes also require `ip nhrp shortcut` to act on the redirect. The scenario indicates the hub is missing a command, and without redirect, the hub cannot signal the spoke to build a direct tunnel, causing spoke-to-spoke traffic to fail or hairpin inefficiently.

Answer

ip nhrp shortcut

Answer

ip nhrp map multicast dynamic

Answer

ip nhrp network-id 100

Question 10

A network administrator is troubleshooting a DMVPN Phase 3 configuration on a Cisco IOS router. The hub router is configured with `ip nhrp redirect`, and spoke routers are configured with `ip nhrp shortcut`. However, spoke-to-spoke communication is failing; packets are being dropped or taking a suboptimal path through the hub. Which two actions should the administrator take to resolve the issue? (Choose two.)

Accepted Answer

Ensure that the spoke routers have a route to the destination spoke's tunnel IP address via the hub or through NHRP.. DMVPN Phase 3 requires `ip nhrp redirect` on the hub and `ip nhrp shortcut` on spokes to enable direct spoke-to-spoke tunnels. Additionally, spokes must have a route to the destination spoke's tunnel IP or subnet via the tunnel interface, often learned through routing protocols. Without these, spoke-to-spoke traffic may fail or be suboptimal. The other options are either irrelevant or would cause broader failures if misconfigured.

Answer

Verify that the hub router has `ip nhrp map multicast dynamic` configured on its tunnel interface.

Answer

Verify that the spoke routers have `ip nhrp map multicast dynamic` configured on their tunnel interfaces.

Answer

Check that the tunnel interface on the hub is configured with `ip nhrp network-id` matching the spokes.

Question 11

A network engineer is implementing DMVPN Phase 2 with EIGRP as the routing protocol. To ensure proper spoke-to-spoke communication, the engineer must configure the hub and spokes correctly. Which two statements about DMVPN Phase 2 with EIGRP are true? (Choose two.)

Accepted Answer

The hub must be configured with ip nhrp map multicast dynamic to forward EIGRP multicast to all spokes.. In DMVPN Phase 2 with EIGRP, the hub must have ip nhrp map multicast dynamic to replicate multicast EIGRP hellos to all spokes. Each spoke must have a static NHRP mapping for the hub's tunnel IP to its NBMA address to establish the initial tunnel and send NHRP registrations. These two configurations are essential for forming EIGRP adjacencies and enabling spoke-to-spoke tunnels through NHRP resolution.

Answer

Spokes must have ip nhrp shortcut configured to enable direct spoke-to-spoke tunnels.

Answer

The hub must be configured with ip nhrp redirect to allow spokes to establish direct tunnels.

Answer

Spokes must have ip nhrp map multicast dynamic configured to receive EIGRP multicast updates.

Question 12

A network administrator is troubleshooting a DMVPN Phase 2 network where spoke-to-spoke communication fails. The hub is a Cisco IOS router, and spokes are configured with NHRP. The administrator notices that the hub has a route to the spokes' tunnel networks, but spokes do not have routes to each other's tunnel networks. Which configuration change on the hub is required to allow spokes to dynamically learn routes to other spokes?

Accepted Answer

Disable next-hop-self on the hub for routes learned from spokes.. In DMVPN Phase 2, spoke-to-spoke communication requires that spokes receive routes to other spokes with the correct next-hop address (the destination spoke's tunnel IP). The hub must not change the next hop to itself. Disabling next-hop-self on the hub for routes learned from spokes ensures that spokes can resolve the destination spoke via NHRP and build direct tunnels.

Answer

Enable NHRP redirect on the hub.

Answer

Configure the hub's tunnel interface as a point-to-multipoint network type for OSPF.

Answer

Disable split horizon on the hub's physical interface.

Question 13

A network administrator is troubleshooting an IPsec VPN tunnel between two Cisco IOS routers that uses IKEv2. Phase 1 is up, but Phase 2 fails to establish. The administrator suspects a mismatch in the IPsec proposal parameters. Which two parameters must match on both peers for the IPsec SA to be established? (Choose two.)

Accepted Answer

Hash algorithm. For IPsec Phase 2, the encryption and hash algorithms in the IPsec proposal must match on both peers. Other parameters like DH group (unless PFS is used), authentication method, and IKE version are part of Phase 1 and are not renegotiated in Phase 2.

Answer

DH group

Answer

IKE version

Answer

Authentication method

Question 14

A network engineer is configuring a DMVPN Phase 3 hub-and-spoke topology using mGRE on the hub and a single physical interface on each spoke. The engineer wants spokes to communicate directly with each other without traffic transiting the hub, and requires that spoke-to-spoke tunnels are dynamically created only when needed. Which NHRP configuration on the hub is required to support this requirement?

Accepted Answer

Enable NHRP redirect on the hub and NHRP shortcut on the spokes.. For DMVPN Phase 3, the hub uses NHRP redirect to notify the originating spoke that a more optimal path exists. The spoke must have NHRP shortcut enabled to act on that redirect and build a direct tunnel to the target spoke. This design eliminates the need for traffic to traverse the hub for spoke-to-spoke flows, while still using the hub for initial resolution.

Answer

Enable NHRP redirect and NHRP shortcut on the hub tunnel interface.

Answer

Enable NHRP shortcut on the hub tunnel interface.

Answer

Enable NHRP redirect on the hub tunnel interface.

Question 15

A network engineer is troubleshooting an MPLS Layer 3 VPN. The service provider uses MP-BGP with VPNv4 address family. The engineer notices that the PE router is not receiving routes from a remote PE for a particular VRF. Which two statements are true regarding the operation of MP-BGP in this environment? (Choose two.)

Accepted Answer

The PE router must have a unique route distinguisher (RD) for each VRF to ensure that routes from different VRFs are kept separate.. In MPLS Layer 3 VPN, MP-BGP uses route distinguishers (RDs) to create unique VPNv4 prefixes and route targets (RTs) to control import and export of routes between VRFs. A unique RD per VRF ensures separation of overlapping addresses, while the export RT attached to routes allows remote PEs to import them into the correct VRF based on matching import RTs.

Answer

The PE router must use a separate BGP session for each VRF to exchange VPNv4 routes.

Answer

The PE router must configure a route target (RT) import on the VRF to control which routes are accepted from other PE routers.

Answer

The PE router must enable the VPNv4 address family under the BGP routing process to exchange VPNv4 routes.

Question 16

A network administrator is deploying a GET VPN solution using Cisco Group Encrypted Transport VPN. The administrator wants to ensure that the key server (KS) and group members (GMs) can successfully establish security associations. Which two statements about GET VPN are true? (Choose two.)

Accepted Answer

The key server must be configured with a RSA key pair to authenticate group members and establish the GDOI control plane.. GET VPN relies on a key server to distribute GDOI policy including TEK and KEK to group members. The key server also uses RSA keys to secure the GDOI control plane. Group members use IPsec tunnel mode without GRE, and they can communicate directly but still depend on the key server for rekeys.

Answer

Group members use IPsec in tunnel mode to encapsulate original IP packets, preserving the original IP header for routing.

Answer

GET VPN requires the use of GRE tunnels between group members to transport encrypted traffic.

Answer

Group members can communicate directly with each other without the need for a central key server after initial key distribution.

Question 17

A network engineer is configuring a GRE tunnel between two Cisco IOS routers, R1 and R2, to carry OSPF traffic over an ISP network. The tunnel source on R1 is GigabitEthernet0/0 (IP 203.0.113.1), and the tunnel destination is R2's GigabitEthernet0/0 (IP 203.0.113.2). The engineer enters the following commands on R1:

interface Tunnel0
 ip address 10.0.0.1 255.255.255.252

tunnel source GigabitEthernet0/0 tunnel destination 203.0.113.2 tunnel mode gre ip

After configuration, the tunnel interface is up/up, but OSPF adjacency does not form. What is the most likely cause?

Accepted Answer

ip pim sparse-mode. For multicast traffic to traverse a GRE tunnel, the tunnel interface must have PIM enabled. The ip pim sparse-mode command activates PIM-SM on the interface, allowing it to forward multicast packets. While global multicast routing must be enabled with ip multicast-routing, the interface-level PIM configuration is what actually permits multicast forwarding on the tunnel.

Answer

ip nhrp map multicast dynamic

Answer

ip multicast-routing

Answer

tunnel mode gre multipoint

Question 18

A network engineer is configuring a VRF-aware IPsec VPN on a Cisco IOS router. The router has two VRFs: VRF-A and VRF-B. The engineer wants to encrypt traffic from VRF-A to a remote site using IPsec. Which additional configuration is required on the crypto map to support VRF-aware IPsec?

Accepted Answer

Specify the VRF name using the set vrf command under the crypto map.. To support VRF-aware IPsec, the crypto map must include the set vrf command to specify which VRF's routing table should be used for encrypted traffic. This ensures that the router looks up the remote peer and destinations in the correct VRF. Without this, the router would use the global routing table, potentially causing routing failures.

Answer

Enable VRF-aware IPsec globally with the crypto vrf command.

Answer

Configure the crypto map under the VRF-aware ISAKMP profile.

Answer

Apply the crypto map to the VRF interface instead of the physical interface.

Question 19

A network administrator is deploying a site-to-site VPN using Cisco IOS GET VPN (Group Encrypted Transport VPN) with GDOI. The key server (KS) and group members (GMs) are configured. Phase 1 and Phase 2 of GDOI are operational, and the KS has successfully pushed the policy to all GMs. However, traffic between two GMs on the same group is being dropped. The administrator verifies that the ACLs on both GMs match and that no firewall is blocking IPsec. Which action should be taken to resolve the issue?

Accepted Answer

Ensure that the GMs have the correct IPsec SA and that the KS has distributed the TEK, and verify that the GMs are using the same IPsec SA and that the traffic is being matched by the ACL and not dropped by the IPsec SA.. GET VPN relies on the KS to distribute a TEK to all GMs. Even after successful GDOI Phase 1 and Phase 2, traffic can be dropped if the TEK is not properly installed or if the IPsec SA is not correctly established on the GMs. Additionally, the ACL must match the traffic for encryption. Verifying these data plane elements is crucial to resolve the drop.

Answer

Ensure the ipsec sa policy includes the correct transform set and that the KS and GMs use the same TEK rekey parameters.

Answer

Confirm that the GMs are using the same IPsec SA and that the KS is configured with the correct rekey authentication, and ensure the GMs have the ip route for the remote subnet pointing to the tunnel.

Answer

Verify that the GMs have the same IPsec SA and that the KS has distributed the TEK, and check if the GMs are using the correct ACL for the traffic.

Question 20

A network engineer is configuring a VRF-aware IPsec VPN on a Cisco IOS router. The router must support multiple customers, each with overlapping IP address spaces, and each customer's traffic must be encrypted separately. Which IPsec configuration element allows the router to select the correct crypto map for each VRF?

Accepted Answer

crypto map map-name 10 ipsec-isakmp vrf vrf-name. To support VRF-aware IPsec, the crypto map must be associated with a VRF using the 'vrf' keyword. This allows the router to maintain separate IPsec policies for each VRF, even with overlapping IP addresses. The crypto map is then applied to the VRF interface, ensuring that traffic from that VRF is encrypted according to its own policy.

Answer

crypto map map-name 10 ipsec-isakmp match address acl-name

Answer

crypto map map-name 10 ipsec-isakmp

Answer

crypto map map-name 10 ipsec-isakmp local-address Loopback0