16. Overlay Tunnels Flashcards
What is GRE (Generic Routing Encapsulation)?
A tunneling protocol that provides connectivity to a wide variety of network-layer protocols by encapsulating and forwarding packets over an IP-based network.
What was GRE originally created for?
To provide transport for non-routable legacy protocols such as IPX
What is added for the encapsulation of GRE?
An extra header with the remote endpoints IP
What are the command needed to establish a tunnel?
Interface tunnel
Tunnel source
Tunnel destination
IP address
What are the optional commands needed to establish a tunnel?
Bandwidth
Keepalive
IP mtu
What is the size of the GRE header?
Minimum 24 bytes
What is recursive routing?
This occurs when a router has a next hop that is not directly connected
Hoe can recursive routing be solved?
By adding a static route
What is IPsec?
A framework of open standards for creating highly secure VPNs
What are the security services for IPsec?
- Peer authentication
- Data confidentiality
- Data integrity
- Replay detection
What are the 2 packet headers of IPsec?
- Authentication header
- Encapsulating Security Payload (ESP)
What does ESP do?
It provides ecryption for the payload and adds a header
What are the 2 modes of packet transport for IPsec?
- Tunnel mode
- Transport mode
What is the difference between tunnel and transport mode?
Tunnel encrypts the complete packet and supports NAT-T
What are the 8 encryption methods IPsec supports?
- DES
- 3DES
- AES
- MD5
- SHA
- DH
- RSA signature
- Pre-Shared key
What is IKE?
The Internet Key Exchange is a protocol that performs authentication between 2 endpoints to establish security associations (ASs). Known as IKE tunnels
What are the two phases of key negotiation for IKE and IPsec?
- Phase 1: Establishes a bidrectional SA between two IKE peers. Both peers can negotiate for phase 2
- Phase 2: Establishes unidirectional IPsec SA
What are the two modes for phase 1?
- Main mode
- Aggresive mode
What are the 5 IPsec VPN solutions?
- Site-to-site
- DMVPN
- GET-VPN
- FlexVPN (combines all
- Remote Access VPN
What is LISP?
A routing architecture and a data & control plane protocol that was created to address routing scalability problems on the internet
What is an EID?
The IP address of an endpoint within a LISP site
What is an ITR?
LISP router that LISP-encapsulate IP-packets coming from EIDs that are destined outside the LISP site
What is an ETR?
LISP router that LISP-deencapsulate IP-packets coming from sites outside the LISP site and destined to EIDs within the LISP site
What is an xTR?
A tunnel router that performs ETR and ITR functions
What is a PITR?
Just like ITR but for non-LISP sites
What is a PxTR
A router that performs PITR and PETR functions
What is a LISP router?
A router that persoms ITR, ETR, PITR, PETR functions
What is a RLOC?
An IPv4 of IPv6 address of an ETR taht is internet facing or network core facing
What is a MS?
Map server
What is a MR?
Map resolver
What is a MS/MR?
When both functions are placed on 1 device
What are the three main components of LISP?
- LISP architecture
- LISP control plane protocol
- LISP data plane protocol
What is the LISP control plane?
Operates in a similar way as DNS. Translates EID into RLOC
What is the LISP data plane?
Encapsulation with a:
- Outer LISP IP header
- Outer LISP UDP header
- Instance ID
What is the LISP port number?
4341
What are the LISP operations?
- Map registration and notify
- Map request and map reply
- LISP data path
- Proxy ETR
- Proxy ITR
What is the Map registration and notify process?
- The ETR sends a map register message to the MS to register associated EIDs and RLOC
- MS sends a map notify voor acknowledgement
How can the MS be chosen to reply for the ETR?
By setting the proxy map reply flag (P-bit) in the map register message
What is the Map request and map reply process?
- Host sends a packet
- When it reaches the ITR, the ITR send a map request to the MR
- MR sends to MS
- MS sends to ETR
- ETR sends the EID to RLOC
What is the port for VXLAN?
UDP 4789
What is the difference between VLAN and VXLAN?
Vlan is 12 bits
Vxlan is 24 bits
What is VTEP?
Virtual tunnel endpoint
What zijn de interfaces van een VTEP?
- Local LAN
- IP interface
What are the supported control planes for VXLAN?
- Multicast
- Unicast VXLAN tunnels
- MP-BGP EVPN
- LISP
