I85PREP
⌘ K
Cisco 300-730 SVPN study materials
Cisco 300-730 SVPN study resources

Cisco 300-730 SVPN: Site-to-site VPNs

Cisco 300-730 SVPN · Work through your exam, one topic at a time.

All guide sections

Site-to-site VPNs

Site-to-site VPNs

This domain tests how you build scalable IPsec overlays between sites: classic crypto-map IPsec, route-based VTI, DMVPN, FlexVPN, and GET VPN. Expect scenario questions on which technology preserves source addresses, which needs NHRP, and how Phase 2 differs from Phase 3.

Core rules

  • Crypto map vs VTI: a crypto map matches traffic through an ACL and is policy-based; a VTI is a routable tunnel interface protected by tunnel protection ipsec profile. VTI simplifies routing and multicast.
  • DMVPN: mGRE plus NHRP. The hub has ip nhrp network-id, ip nhrp map multicast dynamic, and tunnel mode gre multipoint. Spokes map the hub NBMA address, register as NHS clients, and must share the same network-id and tunnel key.
  • DMVPN phases: Phase 1 uses hub-and-spoke only; Phase 2 allows spoke-to-spoke with next-hop preserved; Phase 3 adds ip nhrp redirect on the hub and ip nhrp shortcut on spokes, so the first packet goes via the hub and later packets shortcut.
  • FlexVPN: IKEv2-only, uses virtual-template interfaces and profiles; good for site-to-site and remote access with a common IKEv2/IPsec profile model.
  • GET VPN: group members register with a key server, which distributes KEK/TEK. It encrypts traffic in place without a tunnel overlay, so source and destination IPs are preserved; useful over MPLS.

Worked example

A new DMVPN spoke registers with the hub but cannot reach another spoke directly. On the hub, show dmvpn shows the new spoke as NHRP. On the spoke, show ip nhrp lists the NHS mapping. The hub has ip nhrp redirect; the spoke lacks ip nhrp shortcut. Reasoning: without shortcut, the spoke keeps using the hub as next hop, so Phase 3 direct spoke-to-spoke resolution never occurs. Add ip nhrp shortcut on the spoke and clear the NHRP cache. If the spoke does not register at all, compare ip nhrp network-id and tunnel key on both sides first.

Traps

Crypto-map ACLs must mirror the interesting traffic; a missing reverse entry brings up one direction only. PFS and proposal mismatches fail Phase 2 after Phase 1 succeeds. GRE and IPsec overhead can black-hole large packets, so set tunnel MTU and TCP MSS. NAT-T must be allowed on UDP 4500 when either peer is behind NAT. Do not confuse GET VPN, which has no overlay, with DMVPN, which does.