300-415 Question 35
Single answerA network administrator is configuring a Cisco SD-WAN environment and must establish secure connectivity between two remote sites using IPsec tunnels. The administrator also needs to use GRE for encapsulating non-IP traffic. Which approach should the administrator take to achieve this design?
- A
Configure GRE over IPsec to encapsulate the traffic and provide encryption.
- B
Configure IPsec over GRE to encapsulate the traffic and provide encryption.
- C
Use only IPsec, as it inherently supports non-IP traffic by default.
- D
Use GRE without IPsec, as GRE already provides encryption.
Show answer and explanation
Correct answer: A
Explanation
In Cisco SD-WAN, when a combination of GRE and IPsec is needed, GRE is used to encapsulate the traffic (including non-IP traffic), and IPsec is applied to encrypt the GRE packets, ensuring confidentiality, integrity, and authentication. This approach is known as GRE over IPsec and is the best practice in this scenario.
- A. Correct.
This is the correct approach, as GRE over IPsec ensures that traffic is encapsulated by GRE and then encrypted and secured by IPsec.
- B. Incorrect.
IPsec over GRE is not commonly used because IPsec is typically the outermost protocol to handle encryption and security.
- C. Incorrect.
IPsec does not inherently support encapsulating non-IP traffic, making this option incorrect.
- D. Incorrect.
GRE does not provide encryption; it is purely an encapsulation protocol. Security must be added with IPsec, making this option incorrect.