Question

Difficulty: HardRemote Access and Site-to-Site VPN Concepts

An organization is deploying a Cisco AnyConnect Remote Access VPN solution for remote employees. The security policy mandates that all corporate traffic destined for internal enterprise subnets must be encrypted and forwarded through the VPN tunnel, while standard internet traffic should bypass the tunnel and route directly out the user's local network interface to preserve corporate WAN bandwidth. Additionally, remote clients must dynamically acquire private IP addresses and internal DNS server settings upon successful authentication. Which combination of VPN features and tunneling configurations meets these requirements?

  1. A
    Configure a site-to-site IPsec tunnel using GRE encapsulation with full-tunneling enabled on the headend router.
  2. Configure an SSL/TLS or IPsec Remote Access VPN using split-tunneling with an access list specifying internal corporate destination networks.Answer
  3. C
    Configure an IPsec Remote Access VPN using Authentication Header (AH) in transport mode with split-tunneling disabled.
  4. D
    Configure a site-to-site IPsec tunnel utilizing Encapsulating Security Payload (ESP) in transport mode with dynamic NAT overload applied on the client end.

Answer

The correct architecture requires a Remote Access VPN deployment utilizing split-tunneling controlled by an access list that defines internal corporate network destinations.
Remote Access VPNs are designed for individual client endpoints connecting to a central site, pushing configurations dynamically. Enabling split-tunneling with a targeted destination ACL ensures that only traffic destined for internal corporate networks is encrypted and routed through the tunnel, while local internet access remains unencumbered.

Step-by-Step Solution

1
Identify the VPN operational topology requirement (Remote Access vs. Site-to-Site).
Because individual mobile users require client software (Cisco AnyConnect) to connect dynamically to the headend firewall/router, a Remote Access VPN model must be selected rather than a fixed Site-to-Site topology.
Remote Access VPNs support dynamic client authentication, IP address assignment (DHCP/Local Pool), and parameter pushing to roaming hosts.
2
Analyze the traffic routing security policy requirement (Split-tunneling vs. Full-tunneling).
Split-tunneling must be implemented using an access control list (ACL) that permits corporate subnet ranges.
Split-tunneling directs traffic bound for specified internal enterprise subnets through the encrypted VPN tunnel while allowing local internet traffic to exit directly via the client's local network gateway, preserving WAN bandwidth.
3
Evaluate protocol payload and encapsulation requirements.
Encapsulating Security Payload (ESP) in tunnel mode (or SSL/TLS VPN) is required to ensure data confidentiality via encryption and header encapsulation.
AH provides authentication and integrity without encryption, and transport mode does not hide or encapsulate private RFC 1918 IP headers required for traversing the public internet.

Key Concept

Remote Access VPN Architecture and Split-Tunneling Operation
Rate this question