Cisco 300-730 SVPN key terms

A suite of protocols that authenticates and encrypts IP packets between peers. It provides confidentiality, integrity, and origin authentication at Layer 3 and underpins most site-to-site and many remote-access VPNs.

Internet Key Exchange version 2 negotiates and maintains IPsec security associations. It runs over UDP 500 and 4500, supports built-in NAT traversal, and is the preferred keying protocol on modern Cisco platforms.

Encapsulating Security Payload is the IPsec protocol that encrypts and optionally authenticates packet contents. It uses IP protocol number 50 and is normally chosen over AH because it hides payload data.

Authentication Header is an IPsec protocol providing integrity and origin authentication but no encryption. It uses IP protocol 51 and breaks through NAT, so it is rarely deployed in modern designs.

A one-way agreement between IPsec peers defining the algorithms, keys, and parameters used to protect traffic. Each direction of each protected flow needs its own SA, tracked by SPI and lifetime values.

The Security Parameter Index is a 32-bit identifier carried in ESP or AH headers that tells the receiver which security association to apply. Together with destination address and protocol it uniquely identifies an SA.

The set of parameters (encryption, integrity, DH group, authentication) offered to build the IKE SA. Mismatched proposals are the most common reason IKE negotiations fail before any tunnel forms.

Also called the IPsec or child-SA proposal, it defines the algorithms protecting actual data traffic. It must match on both peers, and it can differ from the Phase 1 proposal.

A named list of one or two IPsec protocols (ESP, AH) paired with specific encryption and hash algorithms. In classic crypto-map configurations, both peers must reference identical transform sets.

A legacy IOS construct that binds ACL-defined interesting traffic to IPsec policies and a peer address. It is applied to an interface to trigger encryption and remains common in older site-to-site deployments.

A configuration object that packages IKEv2 and IPsec parameters for tunnel interfaces, used with SVTI and FlexVPN. It replaces crypto maps and avoids static ACL matching of interesting traffic.

Static Virtual Tunnel Interface is a point-to-point tunnel that carries IPsec traffic and supports routing protocols, multicast, and dynamic routing over the tunnel. It needs no ACL to define interesting traffic.

A design that encapsulates multiprotocol traffic in a GRE tunnel and then protects it with IPsec. It supports multicast and routing protocols but adds overhead and requires careful MTU handling.

Cisco's IKEv2-based framework unifying site-to-site and remote-access VPNs using tunnel interfaces, profiles, and authorization attributes. It supports hub-and-spoke, spoke-to-spoke, and per-user policies.

Dynamic Multipoint VPN builds scalable hub-and-spoke IPsec/GRE topologies using NHRP for address resolution and mGRE for on-demand spoke-to-spoke tunnels. It reduces hub transit for spoke traffic.

Next Hop Resolution Protocol maps tunnel overlay addresses to public NBMA addresses in DMVPN, letting spokes build direct tunnels. It relies on a next-hop server, typically the hub router.

Multipoint GRE is a single tunnel interface that can reach many peers, forming the overlay fabric for DMVPN. It is paired with NHRP to learn each peer's tunnel destination.

A mechanism that encapsulates IKE and ESP in UDP 4500 so traffic passes through NAT devices that cannot translate ESP. It includes keepalives to hold NAT mappings open.

An ACL and route-map or twice-NAT rule that prevents inside VPN traffic from being translated by NAT before it enters the tunnel. Missing exemptions are a classic cause of one-way or failed tunnels.

Traffic matched by an ACL or route that the router decides to encrypt and send through a VPN tunnel. With crypto maps, unmatched traffic is routed in clear.

Tunnel encapsulation shrinks usable packet size, so oversized packets must be fragmented or have DF cleared. Mismatched MTU settings cause stalls in large transfers while pings still succeed.

Cisco's client software that establishes SSL or IKEv2 remote-access VPN connections. It supports split tunneling, posture assessment, and per-group policy pushed by the headend.

Remote access delivered over TLS, typically on TCP 443, using a client or clientless browser portal. It traverses restrictive firewalls well because it resembles ordinary HTTPS traffic.

Datagram TLS carries SSL VPN traffic over UDP to avoid TCP-over-TCP meltdown and reduce latency. AnyConnect prefers DTLS and falls back to TLS when UDP is blocked.

A browser-based SSL VPN portal that gives access to internal web applications, file shares, and bookmarks without installing client software. It supports fewer applications than full tunnel mode.

A policy that sends only specified destination networks through the VPN tunnel while other traffic goes directly to the internet. It conserves headend bandwidth but complicates endpoint security.

The opposite of split tunneling: every packet from the client, including internet-bound traffic, is sent through the VPN headend. It centralizes inspection and policy enforcement.

On an ASA or FTD headend, a configuration object holding the authentication method, address pool, group policy, and protocol settings that a remote-access user connects to.

A set of attributes such as split-tunnel ACL, DNS servers, idle timeout, and banner applied to VPN users after authentication. It is assigned by the connection profile or authorization server.

A range of IP addresses from which the VPN headend assigns an inner address to each connected client. Exhaustion or overlap with internal subnets breaks client connectivity.

An IOS/IOS-XE object that supplies attributes such as address pool, DNS, and split-tunnel ACL to FlexVPN or IKEv2 remote-access clients after they authenticate.

Peers prove identity with X.509 certificates instead of pre-shared keys. It scales better for many spokes and requires a trusted CA chain and valid identity on each device.

A configuration container holding a device's certificate, key pair, and trusted CA certificates. Correct enrollment and clock accuracy are prerequisites for certificate-based IKE to succeed.

A secret string both IPsec peers must know to authenticate each other during IKE. It is simple but does not scale well and is weaker than certificate-based authentication.

A keepalive mechanism that probes an idle peer and tears down SAs when replies stop. It speeds failover and clears stale tunnels after link or path failures.

A command that lists IKEv2 security associations with peer addresses, status, and encryption details. It is the first check when a tunnel will not come up or drops repeatedly.

Displays Phase 2 security associations, including packet and byte counters per SA, encapsulation mode, and transform details. Rising counters confirm traffic is actually being encrypted.

Enables verbose IKEv2 event logging to reveal which proposal, policy, or authentication step fails. It is CPU-intensive and should be used briefly and with care on production devices.

Perfect Forward Secrecy rekeys IPsec keys through a fresh Diffie-Hellman exchange so compromising one key does not expose past sessions. Both peers must agree on the same DH group.

A property where session keys are derived independently and discarded, so long-term key compromise cannot decrypt recorded traffic. It is enabled by specifying a DH group in Phase 2.

The modulus size used for key agreement during IKE and optional rekeying. Both peers must configure the same group, and stronger groups are preferred over legacy group 1 and 2.

The cipher that protects confidentiality, such as AES with 128- or 256-bit keys. Peers must match, and deprecated ciphers like DES or 3DES should be avoided in new designs.

The hash or MAC that detects tampering with VPN packets, such as SHA-256 or AES-GCM's built-in authentication. Mismatched integrity settings cause Phase 1 or Phase 2 proposal failures.

A device setting restricting cryptography to validated algorithms approved for U.S. federal use. Enabling it can disable older ciphers and break tunnels that still rely on them.