2V0-41.24 Question 380
Select 3An organization has deployed VMware NSX to manage their network virtualization. They need to establish secure communication between two remote branch offices over the internet. The network administrator is tasked with configuring a VPN using NSX to ensure secure traffic flow. Which steps are required to deploy a site-to-site IPSec VPN in NSX?
- A
Configure the NSX Edge as the VPN endpoint and define the local and peer subnets
- B
Enable L2 bridging on the NSX Edge to allow secure communication
- C
Set up a security policy in the NSX Distributed Firewall for VPN traffic
- D
Generate and exchange pre-shared keys between the NSX Edge and the remote VPN device
- E
Activate Distributed Logical Routing (DLR) to enable VPN traffic routing between sites
- F
Configure the encryption and authentication settings for the VPN on the NSX Edge
Show answer and explanation
Correct answers: A, D, F
Explanation
To deploy a site-to-site IPSec VPN in NSX, the network administrator must configure the NSX Edge as the VPN endpoint, define the local and peer subnets, generate pre-shared keys for authentication, and set up encryption and authentication settings. These steps ensure secure communication between the two sites. Other options, such as enabling L2 bridging or activating Distributed Logical Routing, are not directly relevant to VPN setup and are used for other networking purposes.
- A. Correct.
Correct: Configuring the NSX Edge as the VPN endpoint and defining the local and peer subnets is a fundamental step in setting up a site-to-site IPSec VPN.
- B. Incorrect.
Incorrect: L2 bridging is not required for setting up a site-to-site IPSec VPN. It is used for connecting virtual and physical networks, not for VPN configuration.
- C. Incorrect.
Incorrect: While security policies can be used to control traffic, they are not a mandatory step in setting up the VPN itself. The VPN configuration is handled at the NSX Edge level.
- D. Correct.
Correct: Pre-shared keys are essential for establishing IPSec VPN connections as they allow for secure authentication between endpoints.
- E. Incorrect.
Incorrect: Distributed Logical Routing (DLR) is not directly related to VPN setup. It is used for routing within NSX environments, but VPN traffic is handled by the NSX Edge.
- F. Correct.
Correct: Configuring encryption and authentication settings is crucial for ensuring the secure operation of the VPN.