350-401 Question 102
Select 3A network engineer is tasked with configuring secure communication between two branch offices over the internet. The engineer decides to use GRE over IPsec tunneling. Which of the following steps are required to successfully set up the GRE over IPsec tunnel?
- A
Configure the GRE tunnel interface with source and destination IP addresses.
- B
Enable IPsec encryption directly on the physical interface without using a crypto map.
- C
Apply a crypto map to the GRE tunnel interface to secure the GRE traffic.
- D
Define an IPsec transform set and specify the encryption and authentication methods.
- E
Ensure the GRE tunnel traffic matches the crypto map's access control list (ACL).
Show answer and explanation
Correct answers: A, D, E
Explanation
When configuring GRE over IPsec, the GRE tunnel must first be established with source and destination IP addresses. To secure the GRE traffic, IPsec must be configured with an appropriate transform set and a crypto map applied to the physical interface. Additionally, the crypto map's ACL must match the GRE traffic to ensure it is encrypted. Misconfigurations, such as applying the crypto map to the GRE interface or skipping the ACL, will prevent the tunnel from functioning properly.
- A. Correct.
Correct. GRE tunnels require configuration of source and destination IP addresses to establish the logical tunnel interface.
- B. Incorrect.
Incorrect. IPsec encryption is applied using a crypto map configuration, not directly on the physical interface without a crypto map.
- C. Incorrect.
Incorrect. Crypto maps are applied to physical interfaces, not the GRE tunnel interface itself.
- D. Correct.
Correct. Defining an IPsec transform set is necessary to specify the encryption and authentication methods for securing the tunnel.
- E. Correct.
Correct. The crypto map's ACL must match the GRE tunnel traffic to ensure that the GRE packets are secured by IPsec.