I85PREP
⌘ K
Cisco ENARSI 300-410 study materials
Cisco ENARSI 300-410 study resources

Cisco ENARSI 300-410: VPN Technologies

Cisco ENARSI 300-410 · Work through your exam, one topic at a time.

All guide sections

VPN Technologies

VPN Technologies tests MPLS Layer 3 VPN, DMVPN, IPsec, GRE, and VRF constructs. Expect questions on control-plane signaling and data-plane encapsulation rather than vendor marketing.

MPLS L3VPN control and forwarding

  • A VRF separates the RIB and FIB. The route distinguisher makes an IPv4 prefix unique in MP-BGP; the route target is the extended community used for import and export.
  • PE routers exchange VPNv4 routes through MP-iBGP. Each route carries a transport label and a VPN label; the transport label switches traffic to the egress PE, while the VPN label identifies the VRF or attachment circuit. Penultimate hop popping may remove the transport label before the egress PE.
  • CE-PE routing can be static, OSPF, BGP, or EIGRP. The PE must redistribute CE routes into MP-BGP with the correct route targets.

DMVPN and IPsec

  • DMVPN uses mGRE plus NHRP. The hub maps spoke NBMA addresses to tunnel addresses. Phase 1 is hub-and-spoke, phase 2 allows direct spoke-to-spoke tunnels, and phase 3 adds NHRP shortcuts with hub summarization.
  • IPsec establishes an IKE SA and then an IPsec SA. ESP provides confidentiality and integrity; AH provides integrity only. Tunnel protection applies a crypto profile to GRE or mGRE, while crypto maps use an ACL to identify interesting traffic.
  • GRE adds 24 bytes, and IPsec adds more overhead. Adjust ip mtu and ip tcp adjust-mss to avoid black holes.

Worked example

PE1 VRF CUST has RD 65000:1 and export RT 65000:100; PE2 imports 65000:100. CE1 sends 10.1.1.0/24 to PE1 through eBGP. PE1 installs the route in VRF CUST, creates the VPNv4 NLRI 65000:1:10.1.1.0/24, attaches the export RT and a VPN label, and sends it over MP-iBGP to PE2. PE2 checks the RT against its import policy. Because 65000:100 matches, PE2 installs the prefix in VRF CUST with next hop PE1 and a label stack. When CE2 sends traffic, PE2 pushes the VPN label and transport label; the P router swaps only the transport label; PE1 pops it and uses the VPN label to select VRF CUST for delivery to CE1.

Traps

  • The RD is not used for import or export; the RT is.
  • The MP-BGP next hop must be reachable in the global table, or use next-hop-self or mpls bgp forwarding.
  • DMVPN phase 2 requires no spoke summarization at the hub; phase 3 supports it.
  • IPsec ACLs must mirror traffic; tunnel protection does not use crypto-map ACLs.
  • MTU black holes occur when GRE and IPsec overhead are ignored.