Exam objective 4.3 — Describe VPN types (IPsec, DMVPN, FlexVPN) and basic cryptography concepts — sits at the heart of how modern enterprises secure their data across untrusted networks like the internet. Without VPNs, every remote office, cloud application, and homeworker would need a dedicated private cable, which is impossibly expensive. This chapter equips you to recognise exactly which flavour of VPN fits which business problem and to understand the cryptographic locks, seals, and identity checks that stop attackers from reading or altering company secrets. For the 350-401 ENCOR, mastering this topic means you can explain not just what a VPN is, but how it makes the wild open internet behave like a private, walled garden.
Jump to a section
A simple way to picture VPN and Cryptography Concepts
Have you ever asked yourself how two offices can exchange their most sensitive financial data using the same internet you use for casual web browsing, without anyone in between ever catching a glimpse?
Picture two solicitors’ firms in different cities that need to swap sealed court documents daily. They don’t trust the public postal service, so they hire a specialist courier. Every morning, a solicitor places the documents inside a metal briefcase, snaps it shut, and scrambles the combination lock using a number only the other firm knows (that’s symmetric encryption). For extra safety, she seals the lid with a wax stamp that shatters if someone tries to pry it open—proving the briefcase hasn’t been tampered with (integrity via hashing). The courier doesn’t own the roads, but he uses a fleet of identical grey vans that blend into ordinary traffic. Yet each van has a pneumatic tube that shoots the briefcase directly from the sender’s loading bay to the receiver’s, bypassing all street-level stops. That tube is a virtual private tunnel—a VPN—punched through the public road system. When hundreds of briefcases need to fly between dozens of offices every hour, the courier sets up a dynamic dispatch where any office can send directly to any other without a central sorting hub, using a colour-coded label that redirects the tube mid-flight (DMVPN). If the fleet is completely modernised with a single standardised locking and routing system that works identically for briefcases, parcels and even visitors’ laptops, that’s FlexVPN. Cryptography supplies the locks, the seals, and the combination secrets. The VPN builds the invisible tube that keeps the courier’s vehicles—and all the snoops on the roads—completely out of the picture.
A Virtual Private Network (VPN) is a technology that creates a secure, encrypted connection—often called a tunnel—across a public network such as the internet. Think of it as wrapping your data in a layer of armour so that even if someone intercepts the packets, all they see is scrambled noise. To achieve that armour, VPNs lean heavily on cryptography.
Cryptography is the science of hiding information. It rests on four main pillars: confidentiality, integrity, authentication, and non-repudiation. Confidentiality means only the intended recipient can read the data; encryption turns readable plaintext into unreadable ciphertext using a mathematical algorithm and a secret key. Integrity guarantees the message wasn’t altered, achieved through hashing—running data through a one-way function that produces a fixed-size digest, like a unique fingerprint. Authentication verifies the identity of the sender or receiver, often with a pre-shared key (PSK) or a digital certificate from a trusted authority. Non-repudiation proves that a sender can’t deny having sent the message; digital signatures provide this by encrypting a hash of the message with the sender’s private key.
Encryption comes in two flavours. Symmetric encryption uses the same key to lock and unlock the briefcase. It’s fast and efficient, ideal for bulk data, and AES (Advanced Encryption Standard) is the gold standard. Asymmetric encryption uses a key pair: a public key that anyone can see, and a private key that must stay secret. If you encrypt with the public key, only the private key can decrypt it—and vice versa. RSA and Elliptic Curve Cryptography (ECC) are common asymmetric methods. Real VPNs combine both: asymmetric cryptography to safely exchange a temporary symmetric key, then symmetric encryption for the heavy lifting.
Hashing is not encryption; it cannot be reversed. Common hashing algorithms include SHA-256 and SHA-512. A tiny change in the input produces a wildly different hash, so any tampering is instantly detectable. In VPNs, hashing protects packet integrity.
Now that we have the cryptographic toolkit, how does a VPN actually use it? IPsec (Internet Protocol Security) is not a single protocol but a framework of standards that can secure any IP traffic. It operates at Layer 3. It provides two main security services: Authentication Header (AH) for integrity and authentication (but without encryption), and Encapsulating Security Payload (ESP) for integrity, authentication and encryption. Most real-world deployments use ESP because they want confidentiality. IPsec can work in transport mode (only the payload is encrypted, often for host-to-host) or tunnel mode (the entire original packet is encrypted and placed inside a new IP packet, the classic site-to-site VPN).
Setting up an IPsec tunnel involves two phases of the Internet Key Exchange (IKE) protocol. IKE Phase 1 establishes a secure, authenticated channel between the two VPN peers. This can run in main mode or aggressive mode (IKEv1) or with a simpler, more secure exchange in IKEv2. The result is an IKE Security Association (SA). Phase 2 negotiates the IPsec SAs that will actually encrypt and authenticate user data. Traffic selectors—often defined by access control lists (ACLs)—decide which packets get sent through the tunnel.
Cisco offers several VPN architectures built on IPsec. A classic site-to-site IPsec VPN requires a static tunnel between two fixed endpoints; great for head office to branch, but cumbersome if you have many branches that need to talk to each other directly.
DMVPN (Dynamic Multipoint VPN) solves that. It uses multipoint GRE (mGRE) tunnels, which allow a single interface to connect to many remote peers, and the Next Hop Resolution Protocol (NHRP) to resolve spoken addresses to physical public addresses. Spokes register with a hub, and when one spoke needs to reach another, it queries the hub for the real address, then builds a direct IPsec tunnel on demand. The result is a full-mesh network without needing to pre-configure every spoke pair.
FlexVPN is Cisco’s unified VPN solution that hinges entirely on IKEv2. It can do site-to-site, hub-and-spoke, spoke-to-spoke, and remote access all from the same configuration template. Unlike DMVPN, which still carries some legacy complexity and different processing for each type, FlexVPN uses a consistent paradigm called IKEv2 configuration payloads and routing protocols to deliver any topology. It is the modern, standardised replacement that simplifies designs.
In summary, VPNs give you a secure pipe through an untrusted sea. IPsec supplies the cryptographic nuts and bolts, DMVPN adds dynamic spoke-to-spoke intelligence, and FlexVPN unifies everything under the IKEv2 umbrella.
Define the interesting traffic
An access control list (ACL) specifies which packets must travel through the VPN. Only traffic matching the ACL triggers the tunnel; everything else uses the normal internet. This step ensures bandwidth is not wasted encrypting public web browsing.
Initiate IKE Phase 1
The two VPN peers exchange proposals for authentication methods (PSK or certificate), encryption algorithms, hashing algorithms, and the Diffie-Hellman group. They authenticate each other and create a secure, encrypted control channel called the IKE Security Association. This is the handshake that sets up all further negotiations.
Perform IKE Phase 2
Inside the secure channel established in Phase 1, the peers negotiate the IPsec Security Associations that will actually carry user data. They agree on the transform set—typically ESP with AES-256 and SHA-256—and build two unidirectional SAs, one for outbound and one for inbound traffic.
Encrypt and encapsulate data
The original IP packet is encrypted and, in tunnel mode, placed inside a brand new IP packet with the VPN endpoints’ addresses. This new packet travels safely across the public internet; any eavesdropper sees only random-looking data.
Decrypt and verify at the receiving endpoint
The remote VPN gateway strips off the outer IP header, decrypts the inner packet, and checks the integrity hash to confirm nothing was altered. If the hash matches, the original packet is delivered to the internal network as if it arrived on a private wire.
Tear down or re-key when finished
When the lifetime of an IPsec SA expires, the peers automatically negotiate new SAs to keep the tunnel secure. If the tunnel is dynamic, like a DMVPN spoke-to-spoke connection, it can be torn down after an idle timeout to save resources, only reappearing when traffic needs to flow again.
A large retail chain with 50 stores and a central data centre needs constant, private communication for credit card transactions, inventory updates, and video surveillance feeds. The IT architect designs a DMVPN solution because the stores must speak directly to each other for some applications, yet manual configuration of 1,225 point-to-point tunnels is out of the question.
First, the network engineer installs a Cisco ISR router at the data centre (the hub) and at each store (the spokes). On the hub, she creates an mGRE tunnel interface and enables NHRP, so the hub automatically keeps a registry of every spoke’s public IP address and internal tunnel address. She then applies an IPsec profile to the tunnel, selecting ESP with AES-256 for encryption and SHA-256 for integrity. For IKEv2, she configures a pre-shared key, though in a larger rollout she would use certificate-based authentication via a Public Key Infrastructure (PKI) for easier rotation.
On each spoke router, the configuration is nearly identical: the same mGRE tunnel interface, NHRP pointing to the hub, and the same IPsec profile. The spoke registers with the hub the moment its internet line comes up. Now, when Store 12 in Manchester needs to send a large inventory feed directly to Store 27 in Edinburgh, this happens:
Store 12’s router sends an NHRP resolution request to the hub, asking “What is the public IP for Store 27’s tunnel address?”
The hub replies with the information, and Store 12 initiates an IKEv2 exchange directly with Store 27.
IKEv2 phase 1 authenticates both routers and generates a secure control channel.
IKEv2 phase 2 negotiates the IPsec SAs, agreeing on AES-256 and SHA-256.
A 10-minute dynamic tunnel springs to life, encrypting the inventory data. Once the transfer finishes and the tunnel idles, it disappears, saving resources.
The engineer monitors the whole fabric from a central dashboard. She can add a new store in minutes by cloning a standard configuration template and updating the spoke’s pre-shared key. Traffic that doesn’t match the crypto ACL—such as guest Wi-Fi—exits directly to the internet without entering the VPN. This design slashes configuration overhead and bandwidth costs while satisfying the PCI DSS auditors who confirmed every card transaction rides inside an AES-256 encrypted envelope.
The 350-401 ENCOR exam tests VPN and cryptography concepts by expecting you to differentiate architectures, order IKE phases correctly, and match cryptographic building blocks to their purpose. Multiple-choice questions frequently ask, “Which VPN type is best for full-mesh connectivity without manually configuring every spoke pair?” The answer is DMVPN. Alternatively, “Which Cisco VPN solution relies solely on IKEv2?” points to FlexVPN.
Be ready for drag-and-drop items that require you to sequence the steps of IKE: Phase 1 authenticates and secures the channel, Phase 2 establishes IPsec SAs, then data transfer begins. They may also ask you to place encryption algorithms (AES), hashing algorithms (SHA-256/512), key exchange methods (Diffie-Hellman), and authentication methods (PSK, RSA signatures) into the correct IKE phase.
Traps to watch for:
Confusing AH with ESP. AH provides integrity and authentication but no encryption. ESP does all three and is the go-to choice; an exam question that mentions confidentiality must point to ESP, not AH.
Treating IPsec as a single protocol rather than a framework. The phrase “IPsec protocol” might be a distractor; the correct terminology is “IPsec suite” or “framework”.
Mixing up IKEv1 and IKEv2 features. IKEv2 supports EAP authentication, MOBIKE (mobility), and a simpler exchange, whereas IKEv1 uses main/aggressive modes. A question describing a VPN that stays up when the client’s IP changes is pointing to IKEv2 with MOBIKE.
Thinking DMVPN only works with static peers. DMVPN uses NHRP for dynamic resolution, enabling spoke-to-spoke on demand.
Believing pre-shared keys scale to large deployments; the exam expects you to recommend certificate-based PKI for hundreds of peers.
Key definitions to memorise:
mGRE: Multipoint Generic Routing Encapsulation – one interface supports many tunnels.
NHRP: Next Hop Resolution Protocol – resolves a spoke’s tunnel address to its public IP.
IKE SA: the secure channel built during Phase 1.
IPsec SA: the unidirectional security association for actual data; you need two for bidirectional traffic.
Transform set: the combination of security protocols and algorithms (e.g., ESP-AES-256-SHA) offered during negotiation.
The exam may also test you on where cryptography fits in the Cisco security model, such as understanding that hashing is used for integrity verification in routing protocols (like OSPF over IPsec) or that digital signatures enforce non-repudiation in site-to-site VPNs. Always link the technology to the business requirement: confidentiality demands encryption, integrity demands hashing, and authentication demands a pre-shared key or certificate.
IPsec is a framework—not a single protocol—that provides confidentiality (ESP), integrity (AH/ESP) and authentication (IKE) for IP packets.
DMVPN uses mGRE tunnels and NHRP to dynamically create spoke-to-spoke IPsec tunnels without pre-configuring every peer, making it ideal for full-mesh large branch networks.
FlexVPN unifies site-to-site, hub-and-spoke, spoke-to-spoke and remote access VPNs under a single IKEv2-only configuration paradigm, replacing the complexity of older methods.
Symmetric encryption (e.g., AES) uses one shared key for both encryption and decryption, excelling at bulk data, while asymmetric encryption (e.g., RSA) uses a key pair to securely exchange symmetric keys.
Hashing is a one-way mathematical fingerprint—algorithms like SHA-256 prove data integrity but cannot be decrypted to recover the original message.
IKE Phase 1 authenticates peers and builds a secure control channel; IKE Phase 2 negotiates the IPsec SAs that actually protect user data.
Digital signatures combine a hash with the sender’s private key, allowing anyone with the public key to verify that the message came from the claimed sender and has not been altered (non-repudiation).
ENCOR questions focus on matching VPN type to business need: use classic IPsec for single site-to-site, DMVPN for dynamic full mesh, FlexVPN when you want a single IKEv2-based solution for all topologies.
These come up on the exam all the time. Here's how to tell them apart.
DMVPN
Relies on mGRE and NHRP for dynamic spoke resolution
Supports IKEv1 and IKEv2, often deployed with IKEv1 in legacy setups
Configuration split across crypto maps and tunnel interfaces
FlexVPN
Built solely on IKEv2, using configuration payloads for address allocation
Unifies site-to-site, hub-and-spoke, and remote access in one interface template
Uses smart defaults and a single IKEv2 profile, greatly simplifying large deployments
IPsec ESP
Provides encryption, integrity and optional authentication
Works with or without encryption (NULL cipher), making it flexible
The default choice for VPNs when confidentiality is required
IPsec AH
Provides only integrity and authentication, no encryption
Cannot be used with NAT because it hashes parts of the outer IP header
Rarely deployed alone; usually seen in exam questions as a distractor
Symmetric Encryption
Uses a single shared secret key for both encrypting and decrypting
Very fast; suited for bulk data like the encrypted traffic inside a VPN
Key distribution must be handled securely out-of-band or via asymmetric exchange
Asymmetric Encryption
Uses a mathematically linked key pair: public and private keys
Slower; primarily used for secure key exchange and digital signatures
Public key can be shared openly; private key never leaves its owner
Pre-Shared Key
A simple password both peers must know; easy to set up for a few devices
Scales poorly; every new peer requires updating the key on all other peers
No built-in mechanism for revocation or centralised identity verification
Digital Certificate (PKI)
Uses a trusted third party (CA) to vouch for peer identity through signed certificates
Scales to thousands of devices by simply enrolling new certificates
Supports revocation lists and automated renewal, essential for enterprise security
Mistake
IPsec is just a single protocol.
Correct
IPsec is a framework of multiple protocols and services—mainly ESP, AH, and IKE—working together.
Beginners hear ‘IPsec’ and assume it’s one monolithic program, like a firewall, rather than a modular suite of standards, which leads to confusion when answering questions about AH vs ESP.
Mistake
Hashing and encryption are interchangeable ways to hide data.
Correct
Encryption is reversible with the correct key; hashing is a one-way function that creates a fixed-length digest and cannot be reversed.
Many newcomers equate all cryptographic functions with ‘scrambling data’. When they see SHA-256 used for integrity, they ask why not just encrypt, missing that hashing is meant to verify, not conceal.
Mistake
DMVPN only works if all sites use Cisco gear.
Correct
While DMVPN is a Cisco proprietary solution, it is built entirely on open standards—mGRE, NHRP, IPsec—so other vendors could implement it if they chose, but the configuration is Cisco-specific.
After learning that IPsec is an open standard, students often assume every VPN feature must be vendor-neutral. DMVPN’s Cisco-first branding tricks them into thinking the protocols are proprietary.
Mistake
A pre-shared key is the most secure authentication method for large VPNs.
Correct
Pre-shared keys become a management nightmare and a security risk as the deployment scales; digital certificates backed by PKI offer far better security and automation.
Hands-on labs often start with PSK for simplicity, leading learners to believe it’s the default choice in production, whereas ENCOR expects you to identify PKI as the recommended enterprise solution.
Mistake
FlexVPN is just Cisco’s new name for DMVPN.
Correct
FlexVPN is a fundamentally different architecture based entirely on IKEv2 with a unified configuration model, while DMVPN still relies on NHRP and mGRE with separate handling for different topologies.
Both serve spoke-to-spoke needs, and marketing language can make them seem like a straightforward upgrade path, but the ENCOR exam explicitly tests their architectural differences.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
IPsec operates at the network layer (Layer 3), securing all IP traffic without caring about the application. SSL VPNs use TLS, which works at the transport layer, and are often clientless (accessed via a browser) with limited application support, making them popular for remote user access rather than site-to-site connectivity.
Encryption provides confidentiality so nobody can read the data; hashing provides integrity so you know the data hasn’t been altered in transit. An attacker might not be able to decrypt a packet, but without a hash they could still try to tamper with it in ways that break communication or inject malicious bits.
DMVPN is Cisco’s implementation of standard protocols like mGRE, NHRP and IPsec. While any vendor could theoretically implement the same standards, Cisco does not license the DMVPN configuration tooling, so practical deployments rely on Cisco hardware or select other vendors that reverse-engineer the feature.
Internet Key Exchange (IKE) is the protocol that automatically negotiates and exchanges the cryptographic keys used by IPsec. It operates in two phases: Phase 1 authenticates the peers and creates a secure channel, then Phase 2 uses that channel to agree on the encryption and authentication methods for the actual data traffic.
FlexVPN simplifies designs by using only IKEv2 and offering a single configuration model for all VPN types, which reduces complexity. However, organisations with a large, stable DMVPN deployment may continue using it because both solutions are supported and the migration effort may not justify the operational gain.
Symmetric is like a single house key that both lock and unlock; fast but you must share the key securely. Asymmetric is like a locked mailbox where anyone can drop mail in using the public slot (public key), but only the owner has the key to open and read it (private key).
You've finished VPN and Cryptography Concepts. Continue through the 350-401 ENCOR study guide to build a complete picture of the exam.
Done with this chapter?