VPN Technologies (IPsec, SSL, GRE, L2TP, DSVPN)
This domain tests tunnel establishment, interesting traffic, and choosing the right VPN for a topology. Questions often involve branch offices with dynamic public addresses or mismatched proposals.
Core rules
- IPsec has IKE phase 1 (ISAKMP SA) and phase 2 (IPsec SA); proposals must match on encryption, hash/authentication, DH group, and lifetime.
- The ACL defines interesting traffic; traffic outside the ACL is not encrypted.
- ESP provides confidentiality and integrity; AH provides integrity but not confidentiality and is often blocked by NAT. NAT-T encapsulates ESP in UDP 4500.
- DSVPN uses mGRE and NHRP so spokes with dynamic addresses can build tunnels to a hub.
- GRE is a simple tunnel that can carry multicast and routing protocols; L2TP is common for remote access; SSL VPN provides clientless or client-based access over TLS.
Worked example
A branch has a dynamic public address and must reach HQ. Classic point-to-point IPsec requires a fixed peer, so use a wildcard/template on the hub or DSVPN. DSVPN fits because the hub learns spoke addresses through NHRP and builds mGRE tunnels. Verify the ACL on both sides, matching proposals, and a route to the tunnel network.
Traps that cost marks
- ACL direction or mirror mismatch between peers.
- Proposal mismatch, such as SHA-256 on one side and SHA-1 on the other.
- Assuming IPsec encrypts all traffic rather than ACL-matched traffic.
- Forgetting the route to the remote subnet.