I85PREP
⌘ K
CCIE Enterprise study materials
CCIE Enterprise study resources

CCIE Enterprise: Transport Technologies and Solutions

CCIE Enterprise · Work through your exam, one topic at a time.

All guide sections

Transport Technologies and Solutions

MPLS L3VPN

A VRF creates a separate routing table; the RD makes otherwise identical prefixes unique inside MP-BGP VPNv4, and the RT controls import/export between VRFs. Packets carry a label stack: an outer transport label (LDP or segment routing) and an inner VPN label. Penultimate hop popping removes the outer label one hop early so the egress does only one lookup.

Tunnels and overlays

GRE carries multicast and non-IP traffic but provides no confidentiality; IPsec (ESP in tunnel mode, most commonly) supplies integrity and encryption. DMVPN = mGRE + NHRP + an IPsec profile applied to the tunnel.

  • Phase 1: hub-and-spoke only; all spokes sit in the hub's tunnel subnet and the hub is always next hop.
  • Phase 2: direct spoke-to-spoke tunnels in the same subnet; the hub must not rewrite next hop (no ip next-hop-self on the hub tunnel), and spokes resolve each other through NHRP.
  • Phase 3: hierarchical/summarised design; spokes point a default at the hub, and NHRP shortcut plus redirect let them build direct tunnels on demand.

FlexVPN uses IKEv2 with virtual-template interfaces for large-scale hub-and-spoke.

Traps

MTU is the most-missed detail: GRE adds 24 bytes before IPsec, so TCP sessions stall unless MSS clamping or tunnel MTU adjustment is configured. Also check IKE version and crypto-profile mismatches, and remember that a route must point into the tunnel for NHRP to be triggered.

Worked rule of thumb

If the requirement says "spokes must reach each other directly while the hub advertises only a default route", select DMVPN phase 3 with NHRP shortcut and redirect - phase 2 needs full routing reachability of spoke networks.