350-401 Question 103
Single answerYour organization needs to establish a secure site-to-site connection between two remote offices using GRE over IPsec. The network team has configured the GRE tunnel, but it is observed that the tunnel is not encrypted. What step is required to ensure that the GRE traffic is encrypted using IPsec?
- A
Apply an IPsec profile to the GRE tunnel interface.
- B
Enable IPsec encryption directly on the GRE tunnel.
- C
Configure a crypto ACL to match GRE traffic and apply it to the IPsec policy.
- D
Use dynamic IPsec instead of GRE to simplify the configuration.
Show answer and explanation
Correct answer: C
Explanation
To secure GRE traffic with IPsec, a crypto ACL must be configured to identify the GRE-encapsulated traffic that needs to be encrypted. The ACL is then associated with an IPsec transform set and applied to the IPsec policy. Without this step, the GRE traffic will remain unencrypted, as IPsec does not automatically protect GRE traffic unless explicitly configured to do so.
- A. Incorrect.
Incorrect. IPsec profiles are not applied directly to GRE tunnel interfaces. IPsec must be configured to match and protect GRE traffic using crypto ACLs and a transform set.
- B. Incorrect.
Incorrect. IPsec encryption cannot be enabled directly on a GRE tunnel. GRE encapsulation happens before IPsec encrypts the traffic.
- C. Correct.
Correct. A crypto ACL is required to identify the GRE traffic that needs to be encrypted by IPsec. This ACL is then applied to the IPsec policy to protect the traffic.
- D. Incorrect.
Incorrect. Dynamic IPsec is not a replacement for GRE over IPsec. GRE over IPsec is used when you need multiprotocol support and additional features like multicast or routing protocols.