350-401 Question 522
Select 4A network administrator is tasked with configuring a site-to-site IPsec VPN between two routers to securely connect two branch offices. Both routers are using IPsec with pre-shared keys for authentication. During the configuration, the administrator must ensure that the IPsec tunnel is established securely and performs traffic encryption. Which of the following steps are required to properly configure the IPsec VPN?
- A
Define an ISAKMP policy and configure pre-shared key authentication
- B
Configure an access control list (ACL) to define interesting traffic
- C
Enable GRE tunneling before applying IPsec configuration
- D
Define transform sets and apply them to the crypto map
- E
Assign the crypto map to the appropriate interface
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To successfully configure a site-to-site IPsec VPN, several key steps must be followed: defining an ISAKMP policy for Phase 1, configuring ACLs to identify traffic for encryption, defining and applying transform sets to specify security algorithms, and assigning the crypto map to the router's interface. GRE tunneling is not required unless there is a specific need for it, such as supporting routing protocols over the IPsec tunnel.
- A. Correct.
Defining an ISAKMP (IKE Phase 1) policy and configuring pre-shared key authentication is necessary to establish a secure communication channel and authenticate the peers.
- B. Correct.
An ACL is required to identify the traffic that should be encrypted by the IPsec tunnel, commonly referred to as 'interesting traffic'.
- C. Incorrect.
GRE tunneling is not a mandatory requirement for configuring IPsec tunnels. GRE is only used in specific cases such as routing protocol support over IPsec.
- D. Correct.
Defining transform sets is necessary to specify the encryption and hashing algorithms that the IPsec tunnel will use. These must then be applied to the crypto map.
- E. Correct.
The crypto map must be applied to the appropriate interface to enable the IPsec tunnel configuration on the router.