N10-009 Question 89
Single answerA network administrator is deploying a site-to-site VPN between two branch offices. The routers already support GRE tunnels for routing multiple internal subnets, but company policy now requires confidentiality for all traffic crossing the internet. After the change, dynamic routing across the tunnel must continue to work, and the original packet headers should be protected from modification only where appropriate. Which solution best meets these requirements?
- A
Use GRE by itself because it can encrypt the tunneled traffic while carrying multiple routed protocols
- B
Use IPSec AH over the GRE tunnel because AH provides encryption and protects the encapsulated payload
- C
Use GRE over IPSec with ESP so the GRE tunnel can carry the routed traffic and IPSec can provide confidentiality
- D
Use ICMP with IKE because IKE negotiates secure echo sessions for routing updates
Show answer and explanation
Correct answer: C
Explanation
The best answer is to use GRE over IPSec with ESP. GRE is useful when a network needs to tunnel traffic such as dynamic routing protocols or multiple internal networks between sites. However, GRE does not provide encryption. To meet the confidentiality requirement, IPSec ESP should be added. ESP provides encryption and can also provide integrity and authentication, making it the appropriate IPSec component when privacy is required. AH is not sufficient because it does not encrypt data. IKE is the key management protocol used to negotiate IPSec security associations, but it is not itself the data-carrying protocol for the tunnel. This design aligns with common vendor and industry guidance for site-to-site VPNs where GRE functionality is needed alongside IPSec protection.
- A. Incorrect.
Incorrect. GRE is a tunneling protocol, not an encryption protocol. It is commonly used to encapsulate traffic, including routing protocols and multicast traffic, across an IP network, but by itself it does not provide confidentiality or strong authentication. A common misconception is that tunneling automatically means encryption; GRE does not encrypt payloads.
- B. Incorrect.
Incorrect. AH does not provide encryption. Authentication Header provides integrity and authentication for packets, but not confidentiality. In addition, AH protects parts of the IP header, which makes it less compatible with NAT. If the requirement is confidentiality for traffic crossing the internet, AH alone does not satisfy it.
- C. Correct.
Correct. GRE over IPSec with ESP is a common real-world design when an organization needs GRE functionality and encryption. GRE handles encapsulation so dynamic routing protocols and multiple internal subnets can traverse the tunnel, while IPSec ESP provides confidentiality and can also provide integrity/authentication. This combination is widely used because native IPSec alone does not replace GRE's ability to carry certain routed traffic in the same way.
- D. Incorrect.
Incorrect. ICMP is used for control and diagnostic messaging, such as echo request/reply for ping, not for secure transport of routing updates. IKE is used to negotiate security associations and keys for IPSec, not to create 'secure ICMP sessions.' This distractor targets confusion between IKE's role in VPN negotiation and unrelated protocols like ICMP.