Examkin

Soru

Zorluk: ZorVirtual Private Networks and Remote Access Security

A network engineer is configuring a site-to-site VPN tunnel between two enterprise office locations. Unicast IP traffic successfully traverses the tunnel using standard IPsec transport. However, OSPF routing protocol neighbor adjacencies fail to form across the VPN, preventing dynamic routing updates from being exchanged. Which solution should the engineer implement to enable dynamic routing protocols across the encrypted connection?

  1. Encapsulate the traffic using a Generic Routing Encapsulation (GRE) tunnel and secure the GRE tunnel with IPsec.Cevap
  2. B
    Switch the IPsec protocol from Encapsulating Security Payload (ESP) to Authentication Header (AH) to pass Layer 3 multicast headers natively.
  3. C
    Reconfigure IKE Phase 1 to transmit over TCP port 443 instead of UDP port 500 to allow multicast routing traffic.
  4. D
    Modify the IPsec Security Association (SA) settings to transport Phase 2 traffic using TCP instead of UDP to ensure reliable delivery of routing packets.

Cevap

Encapsulate the traffic using a Generic Routing Encapsulation (GRE) tunnel and secure the GRE tunnel with IPsec.
Native IPsec does not support broadcast or multicast traffic, which routing protocols like OSPF require to form neighbor adjacencies. Generic Routing Encapsulation (GRE) encapsulates multicast traffic into standard unicast IP packets. By combining GRE with IPsec (GRE over IPsec), the GRE tunnel handles the multicast routing packets while IPsec provides confidentiality and integrity for the encapsulated GRE tunnel.

Adım Adım Çözüm

1
Analyze the technical limitation of standard native IPsec tunnels.
Native IPsec (ESP/AH) only encapsulates and transports unicast IP packets. It cannot directly encapsulate multicast or broadcast traffic.
Routing protocols such as OSPF rely on multicast packets (224.0.0.5 and 224.0.0.6) to discover neighbors and exchange Link-State Advertisements (LSAs).
2
Identify a tunneling protocol that supports multicast traffic.
Generic Routing Encapsulation (GRE) creates a virtual point-to-point link that can encapsulate multiprotocol, broadcast, and multicast traffic into unicast IP packets.
GRE creates the necessary wrapper for OSPF multicast packets, but GRE by itself does not provide encryption or security.
3
Combine GRE encapsulation with IPsec encryption (GRE over IPsec).
OSPF multicast packets are encapsulated inside a GRE unicast packet, which is then encrypted by IPsec for secure transmission across the untrusted network.
Combining both protocols satisfies both requirements: supporting multicast dynamic routing and securing the communication channel.

Anahtar Kavram

GRE over IPsec Multicast Tunneling
Bu soruyu puanla

Konular

Virtual Private Networks and Remote Access Security

Bu konudan daha fazla soru