350-401 Question 101
Single answerAn organization has set up a GRE tunnel between two branch offices to allow for the transmission of non-IP traffic. However, the network team notices that the data being transmitted over the GRE tunnel lacks encryption and is subject to interception. Which configuration should be implemented to secure the traffic while maintaining the existing GRE tunnel?
- A
Configure IPsec in tunnel mode to encapsulate and encrypt the GRE traffic.
- B
Replace the GRE tunnel with an IPsec tunnel, as they cannot coexist.
- C
Enable IPsec in transport mode to encrypt the GRE payload.
- D
Use a dynamic GRE tunnel with built-in encryption to secure the traffic.
Show answer and explanation
Correct answer: A
Explanation
A GRE tunnel is capable of encapsulating a variety of traffic types, but it does not provide encryption. To secure GRE traffic, IPsec can be applied in tunnel mode. This ensures that the GRE traffic is encapsulated and encrypted, securing it from potential interception while maintaining the benefits of GRE tunneling.
- A. Correct.
Correct: Configuring IPsec in tunnel mode allows the GRE traffic to be encapsulated and encrypted, ensuring confidentiality and security over the public network.
- B. Incorrect.
Incorrect: GRE and IPsec can coexist. You do not need to replace the GRE tunnel; instead, you can secure it with IPsec.
- C. Incorrect.
Incorrect: IPsec in transport mode only encrypts the payload but does not encapsulate the GRE tunnel itself. This would leave the GRE header exposed.
- D. Incorrect.
Incorrect: GRE itself does not have built-in encryption capabilities. Dynamic GRE refers to automatic tunnel creation but does not inherently secure traffic.