Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) v1.2SecurityMedium
A network architect is designing a new branch office network that needs to securely connect to the corporate data center over the public internet. The design requires a solution that can dynamically establish secure tunnels between multiple spoke sites and a central hub, as well as directly between spoke sites if needed, without requiring pre-configuration of every possible spoke-to-spoke tunnel. Which VPN technology best fits these requirements?
- AStatic IPsec VPN
- BFlexVPN
- CGRE over IPsec
- DDMVPN
Show answer & explanationAnswer & explanation
Correct answer: D. DMVPN
DMVPN (Dynamic Multipoint VPN) is specifically designed for hub-and-spoke and spoke-to-spoke VPN architectures. It uses NHRP (Next Hop Resolution Protocol) to dynamically discover spoke IP addresses and establish direct spoke-to-spoke tunnels on demand, eliminating the need for complex static configurations.
Why the other options are wrong
- A. Static IPsec VPNs require manual configuration for every tunnel, which is not scalable for dynamic spoke-to-spoke.
- B. FlexVPN is a unified IKEv2-based VPN solution that can achieve DMVPN-like functionality but is a broader framework; DMVPN is the more direct and established answer for dynamic spoke-to-spoke with NHRP.
- C. GRE over IPsec provides a generic encapsulation but doesn't inherently offer dynamic spoke-to-spoke capabilities without additional protocols like DMVPN.
DMVPN (Dynamic Multipoint VPN)
A Cisco solution that provides a scalable and flexible way to create a full-mesh or hub-and-spoke VPN topology without requiring static configuration of every spoke-to-spoke tunnel.
- Uses mGRE (multipoint GRE) to support multiple GRE tunnels with a single interface.
- Uses NHRP (Next Hop Resolution Protocol) to discover spoke public IP addresses.
- Leverages IPsec for encryption and authentication.
- Enables dynamic spoke-to-spoke tunnels on demand, reducing hub load.
Memory trick: VPNs Connect Sites: Static, GRE, DMVPN, FlexVPN