DMVPN

Question 1

What is the primary function of the Next Hop Resolution Protocol (NHRP)?

Answer 1

Provides address resolution for hosts on nonbroadcast multi-access (NBMA) networks

This protocol helps in determining the next hop address for data packets in specific network configurations.

Question 2

What are NHRP next-hop servers (NHSs) responsible for?

Answer 2

• Registering addresses or networks
• Maintaining an NHRP repository
• Replying to queries from next-hop clients (NHCs)

NHSs play a crucial role in the NHRP protocol by managing address registrations and responding to client queries.

Question 3

What is the NBMA address?

Answer 3

The transport (underlay) address

Question 4

What is the purpose of Redirect messages in DMVPN Phase 3?

Answer 4

To notify the encapsulator that a specific network can be reached by a more optimal path

This involves using a spoke-to-spoke tunnel.

Question 5

In DMVPN Phase 1, where are VPN tunnels created?

Answer 5

Only between spoke and hub sites

Traffic between spokes must traverse the hub to reach any other spoke.

Question 6

What does DMVPN Phase 2 provide beyond DMVPN Phase 1?

Answer 6

Additional capability for spoke-to-spoke communication

It allows the creation of an on-demand VPN tunnel between the spoke devices.

Question 7

True or false: DMVPN Phase 2 allows summarization.

Answer 7

FALSE

DMVPN Phase 2 does not allow next-hop preservation.

Question 8

What does Phase 2 of DMVPN not support?

Answer 8

Spoke-to-spoke communication between different DMVPN networks

This limitation affects multilevel hierarchical DMVPN configurations.

Question 9

In DMVPN Phase 3, what type of message does the hub send to the spoke that originated the packet flow?

Answer 9

NHRP redirect message

This message provides the necessary information for the spoke to resolve the destination host/network.

Question 10

What is the purpose of the NHRP redirect message in DMVPN Phase 3?

Answer 10

To provide necessary information for the originator spoke to initiate a resolution of the destination host/network

This allows for more efficient routing and communication between spokes.

Question 11

In DMVPN Phase 3, what does NHRP do with paths?

Answer 11

NHRP installs paths in the routing table for the shortcuts it creates

This allows for more efficient routing by enabling direct communication between spokes.

Question 12

What does NHRP shortcuts modify in the routing table?

Answer 12

• The next-hop entry for existing routes
• Adds a more explicit route entry

This modification enhances routing efficiency and reduces latency.

Question 13

What does DMVPN Phase 3 support in terms of network management?

Answer 13

Summarization of networks at the hub

This allows for more efficient routing and management of multiple spoke routers.

Question 14

What command is used to configure the DMVPN tunnel as an mGRE tunnel?

Answer 14

tunnel mode gre multipoint

This command sets the tunnel mode to multipoint GRE, which is essential for DMVPN configurations.

Question 15

What command is used to enable NHRP on the tunnel interface?

Answer 15

ip nhrp network-id 1-4294967295

This command uniquely identifies the DMVPN tunnel for the virtual interface.

Question 16

What is the significance of the NHRP network ID?

Answer 16

Locally significant

It is used to identify a DMVPN cloud on a router.

Question 17

Multiple tunnel interfaces can belong to the same DMVPN cloud. True or False?

Answer 17

TRUE

This allows for flexibility in network design.

Question 18

Where you link the IKEv2 keyring to when configuring IPsec?

Answer 18

IKEV2 Profile

Question 19

What two configuration settings do you need to link within the IPsec Profile?

Answer 19

set IKEV2 profile and transform-set

Question 20

Where do you set transport or tunnel mode when configuring IPsec?

Answer 20

crypto ipsec transform-set
mode transport

Question 21

Where do you link the front door VRF when configuring IPsec?

Answer 21

Under IKEv2 Profile
match fvrf name

Question 22

What do you need to match in the ikev2 profile?

Answer 22

match identity remote address 0.0.0.0

Question 23

What is the purpose of IKE SA?

Answer 23

Used for control plane functions like IPsec key management and management of IPsec SAs

IKE SA is essential for establishing secure communication in IPsec.

Question 24

What is the purpose of IPsec SA?

Answer 24

Used for data plane functions to secure data transmitted between two different sites.

Question 25

How many **IKE SA** are there between endpoints?

Answer 25

One ## Footnote There is only one IKE SA between endpoints.

Question 26

Can multiple **IPsec SAs** be established between the same two endpoints?

Answer 26

Yes ## Footnote Multiple IPsec SAs can be established between the same two endpoints.

Question 27

Are **IPsec SAs** unidirectional or bidirectional?

Answer 27

Unidirectional ## Footnote IPsec SAs are unidirectional.

Question 28

How many **IPsec SAs** are required to exchange network traffic between sites?

Answer 28

At least two ## Footnote One inbound and one outbound IPsec SA are required.

Question 29

What are the two modes of **IPsec**?

Answer 29

* Tunnel mode * Transport mode ## Footnote Tunnel mode encrypts the entire original packet, while transport mode encrypts only the packet payload.

Question 30

In **Tunnel mode**, what does IPsec do to the original packet?

Answer 30

Encrypts the entire original packet and adds a new set of IPsec headers ## Footnote These new headers are used to route the packet and provide overlay functions.

Question 31

In **Transport mode**, what does IPsec encrypt?

Answer 31

Only the packet payload ## Footnote This mode does not provide overlay functions and routes based on the original IP headers.

Question 32

True or false: **Transport mode** provides overlay functions.

Answer 32

FALSE ## Footnote Transport mode only encrypts the payload and does not add new IPsec headers for routing.

Question 33

What is the extra overhead added by the **GRE IP header**?

Answer 33

20 bytes ## Footnote The GRE IP header contributes to the total overhead in network configurations.

Question 34

How many bytes of overhead do the **GRE flags** add?

Answer 34

4 bytes ## Footnote This overhead is part of the total encapsulation in GRE.

Question 35

What is the extra overhead added by the **IPsec IP header**?

Answer 35

20 bytes ## Footnote The IPsec IP header also contributes to the overall overhead in secure communications.

Question 36

True or false: **IPsec tunnel mode** for DMVPN networks adds perceived value.

Answer 36

FALSE ## Footnote IPsec tunnel mode adds 20 bytes of overhead without providing additional benefits.

Question 37

What mode should be used for **encrypted DMVPN tunnels**?

Answer 37

Transport mode ## Footnote Transport mode is preferred for its efficiency in encrypted DMVPN configurations.

Question 38

What are the **four components** used in Pre-shared Key Authentication for IPsec tunnel protection?

Answer 38

* IKEv2 keyring * IKEv2 profile * IPsec transform set * IPsec profile ## Footnote These components work together to establish secure IPsec tunnels using pre-shared keys.

Question 39

Where do you define a peer to use a pre-shared key when configuring IPsec?

Answer 39

crypto ikev2 keyring

Question 40

What command would you use to on a DMVPN hub to map NBMA addresses used as destinations for broadcast or multicast packets to be sent across the network?

Answer 40

ip nhrp map multicast dynamic

Question 41

What command would you use to on a DMVPN spoke to map NBMA to NHS and provide functions for routing protocols?

Answer 41

ip nhrp nhs 192.168.100.11 nbma 172.16.11.1 multicast

Question 42

What command do you need for phase 3 DMVPN on a hub router?

Answer 42

ip nhrp redirect

Question 43

What command do you need for phase 3 DMVPN on a spoke router?

Answer 43

ip nhrp shortcut

Question 44

True or false: The **NHRP authentication** password is stored securely.

Answer 44

FALSE ## Footnote The password is stored in plaintext, making it weak.

Question 45

How do you enable **NHRP authentication**?

Answer 45

Using the command: ip nhrp authentication password ## Footnote This command is used in the interface parameter.

Question 46

What does the interface parameter command - ip nhrp registration no-unique do?

Answer 46

It stops routers from placing the unique NHRP message flag in registration request packets sent to the NHS. This allows clients to reconnect to the NHS even if the NBMA address changes. | This should be enabled on all DHCP-enabled spoke interfaces.

Question 47

How are overwritten next-hop addresses indicated in the **routing table**?

Answer 47

By the percent sign (%) ## Footnote This notation helps identify which next-hop addresses have been modified by NHRP.

Question 48

For IKEV1, instead of a profile what do you need to configure?

Answer 48

Crypto isakmp policy 10 encr aes 128 hash sha256 authentication pre-share group 16

Question 49

What configuration defines a PSK to be used for any ISAKMP neighbor?

Answer 49

crypto isakmp key avery address 0.0.0.0

Question 50

Under a ISAKMP policy, what four components are needed for the configuration?