2V0-41.24 Question 388
Select 3An organization is setting up a new Tier-0 gateway for VPN support in their NSX-T environment. They want to ensure the Tier-0 gateway is correctly configured to terminate an IPsec VPN connection. Which of the following steps are required to deploy and configure the Tier-0 gateway and segments to support the VPN connection?
- A
Configure a Tier-0 gateway and attach it to an uplink segment with external connectivity.
- B
Create a VPN profile and associate it with a local endpoint configured on the Tier-0 gateway.
- C
Enable BGP on the Tier-0 gateway to advertise VPN traffic to the data center.
- D
Add a static route in the Tier-0 gateway pointing to the remote VPN subnet.
- E
Enable NAT on the Tier-0 gateway to translate VPN traffic to internal subnets.
Show answer and explanation
Correct answers: A, B, D
Explanation
To deploy and configure a Tier-0 gateway for VPN support, several steps are required. The gateway must have an uplink segment to ensure external connectivity, a VPN profile and local endpoint must be created to establish the VPN tunnel, and static routes must be configured to route traffic through the VPN. While features like BGP and NAT may be used in specific scenarios, they are not required for the basic setup of a Tier-0 gateway for VPN support.
- A. Correct.
Correct: To support VPN connectivity, the Tier-0 gateway must be attached to an uplink segment with external connectivity to ensure it can communicate with the remote VPN endpoint.
- B. Correct.
Correct: A VPN profile and local endpoint are mandatory to configure and terminate an IPsec VPN on the Tier-0 gateway.
- C. Incorrect.
Incorrect: Enabling BGP is not strictly required for VPN support. While it can assist in dynamic routing, it is not a mandatory step for basic VPN configuration.
- D. Correct.
Correct: Adding a static route ensures that traffic destined for the remote VPN subnet is routed correctly through the VPN tunnel.
- E. Incorrect.
Incorrect: NAT is not a requirement for VPN traffic. NAT might be used in specific cases, but it is not a necessary step in the general VPN configuration process.