2V0-41.24 Question 378
Select 3An organization is deploying a Virtual Private Network (VPN) in a VMware NSX-T environment to provide secure communication between its on-premises data center and a public cloud. The administrator decides to configure a Layer 3 IPsec VPN. Which of the following steps are required to successfully deploy the VPN in NSX-T?
- A
Create an IPsec VPN service on the Tier-0 Gateway.
- B
Configure a Local Endpoint with the on-premises data center's IP address.
- C
Define a Policy-Based VPN rule to specify traffic selectors.
- D
Enable NAT on the Tier-1 Gateway to route VPN traffic.
- E
Establish a BGP session between the VPN peers.
Show answer and explanation
Correct answers: A, B, C
Explanation
To deploy a Layer 3 IPsec VPN in NSX-T, the administrator must configure an IPsec VPN service on the Tier-0 Gateway, define a Local Endpoint to establish the tunnel, and create a Policy-Based VPN rule to determine which traffic traverses the VPN. NAT on the Tier-1 Gateway is unrelated to this configuration, and while BGP can be used for routing, it is not a mandatory requirement for VPN deployment.
- A. Correct.
Correct: Creating an IPsec VPN service on the Tier-0 Gateway is required to enable VPN functionality and define the parameters for the VPN connection.
- B. Correct.
Correct: A Local Endpoint must be configured with the on-premises data center's IP address to establish the VPN tunnel and define the local side of the connection.
- C. Correct.
Correct: A Policy-Based VPN rule is necessary to specify traffic selectors that define which traffic should traverse the VPN tunnel.
- D. Incorrect.
Incorrect: NAT is not required on the Tier-1 Gateway for VPN traffic. VPN configuration and routing are handled on the Tier-0 Gateway in this scenario.
- E. Incorrect.
Incorrect: While BGP can be used for dynamic routing in certain scenarios, it is not a mandatory step for deploying a Layer 3 IPsec VPN. Static routing can also be used.