300-420 Question 202
Select 3A company has two branch offices that need to communicate securely over the internet. They decide to use a GRE tunnel to encapsulate traffic between the two sites. During the design phase, the network engineer must configure the tunnel to ensure proper routing and connectivity. Which of the following are design considerations for implementing GRE tunnels in this scenario?
- A
Ensure that the GRE tunnel endpoints have routable IP addresses on the public internet.
- B
Configure a routing protocol such as OSPF or EIGRP within the GRE tunnel to exchange routes between the two sites.
- C
Enable encryption on the GRE tunnel to secure the data natively within the tunnel.
- D
Verify that the GRE tunnel destination IP address is reachable via the source interface of the tunnel.
- E
Use the same IP addresses for both the tunnel source and destination to simplify configuration.
Show answer and explanation
Correct answers: A, B, D
Explanation
GRE tunnels are widely used to encapsulate traffic between remote sites over public or private networks. For proper design and implementation, the endpoints must have routable IPs, the destination must be reachable, and a routing protocol can be used within the tunnel for route exchange. However, GRE does not natively provide encryption, and additional protocols like IPsec are required for securing data.
- A. Correct.
Correct: GRE tunnel endpoints must have routable IP addresses on the public internet to ensure the encapsulated traffic can reach the other endpoint over the internet.
- B. Correct.
Correct: To exchange routes between the two sites and ensure proper traffic forwarding, a routing protocol like OSPF or EIGRP can be configured within the tunnel.
- C. Incorrect.
Incorrect: GRE does not natively provide encryption. If encryption is required, an additional protocol like IPsec must be used.
- D. Correct.
Correct: The GRE tunnel destination IP address must be reachable via the source interface for the tunnel to establish connectivity.
- E. Incorrect.
Incorrect: Using the same IP addresses for both the source and destination is not valid and will result in configuration errors.