2V0-41.24 Question 193
Select 3An organization is planning to implement IPSec VPN between two sites using VMware NSX. The network administrator must decide whether to use a policy-based or route-based VPN. Which of the following statements accurately describes the differences between policy-based and route-based IPSec VPNs to help with the decision?
- A
Policy-based VPNs use ACLs or security policies to define VPN traffic, while route-based VPNs rely on tunnel interfaces and routing tables.
- B
Route-based VPNs are more scalable for dynamic and multi-site connectivity compared to policy-based VPNs.
- C
Policy-based VPNs are preferred in scenarios where granular control of specific traffic flows is required.
- D
Route-based VPNs require more complex configuration and are only useful for static point-to-point connections.
- E
Policy-based VPNs provide support for dynamic routing protocols, unlike route-based VPNs.
Show answer and explanation
Correct answers: A, B, C
Explanation
Policy-based and route-based IPSec VPNs have distinct use cases. Policy-based VPNs use ACLs or policies to define traffic and are ideal for granular traffic control. Route-based VPNs, on the other hand, use tunnel interfaces and routing tables, providing greater scalability and flexibility, especially for dynamic and multi-site environments. Understanding these differences helps administrators choose the appropriate VPN type for their specific requirements.
- A. Correct.
Correct: Policy-based VPNs use ACLs or security policies to define which traffic is encrypted and sent through the VPN tunnel, while route-based VPNs rely on virtual tunnel interfaces and routing tables to handle traffic.
- B. Correct.
Correct: Route-based VPNs are more scalable and flexible because they allow the use of dynamic routing protocols and simplified configurations for multi-site VPNs.
- C. Correct.
Correct: Policy-based VPNs enable granular control over specific traffic flows using ACLs or policies, making them suitable for scenarios with strict control requirements.
- D. Incorrect.
Incorrect: Route-based VPNs are not limited to static connections; they support dynamic routing protocols and are generally easier to configure and manage for multiple sites.
- E. Incorrect.
Incorrect: Policy-based VPNs do not support dynamic routing protocols; this capability is a key feature of route-based VPNs.