GET VPN

Question 1

What is GET VPN

Answer 1

GETVPN (Group Encrypted Transport VPN) is a tunnel-less VPN technology meant for private networks like MPLS VPN where a single SA (Security Association) is used for all routers in a group.

Question 2

What are 3 advantages of GET VPN?

Answer 2

• Its encryption allows for HIPPA and PCI compliant any-to-any tunneless VPNs between endpoints
• Establishes spoke-to-spoke connectivity faster than DMVPN
• Supports multicast and QOS

Question 3

If GET VPN encrypts the entire packet how does it still uses the original IP header?

Answer 3

It uses “Tunnel Mode with Address Preservation” that copies the original source and destination from the inner IP header to the outer IP header

Question 4

What are the 4 main components of GET VPN?

Answer 4

• Group Member (GM)
• Key Server (KS)
• Group Domain of Interpretation
• IPSec

Question 5

What encryption method does GET VPN use?

Answer 5

ESP

Question 6

What does the GET VPN Key Server do?

Answer 6

Group registration and authentication of Group Members

Question 7

What are the 3 steps of Group Member registration?

Answer 7

• GM attempts to register with KS
• KS checks its group ID and IKE credentials
• KS then sends the group VPN policy, GM Key Encryption Key (KEK), and Traffic Encryption Key (TEK)

Question 8

What is the Key Encryption Key (KEK) used for?

Answer 8

KS uses it to encrypt re-key messages, GM uses it to decrypt rekey messages

Question 9

In GET VPN what is the Traffic Encryption Key (TEK) used for?

Answer 9

The TEK becomes the IPSec SA used by GMs to encrypt and decrypt normal traffic

Question 10

What is Group Domain of Interpretation (GDOI)?

Answer 10

• Group key management protocol used between KS and GMs
• Protected with ISAKMP phase 1

Question 11

How is Key Server redundancy accomplished?

Answer 11

Two or more Key Servers communicate with Cooperative Key Server Protocol authenticating each other and maintaining state.

Question 12

When are 2 times that a KS sends rekeying messages

Answer 12

• When the existing IPSec SA is about to expire
• When the security policy is changed

Question 13

What 2 methods can rekeying messages be sent in?

Answer 13

• Unicast
• Multicast

Question 14

What is the advantage of Unicast mode?

Answer 14

• Upon receiving a new key the GM sends an acknowledgement back to the KS.
• If KS doesn’t receive an ACK after 3 transmissions the GM is deleted from the group

Question 15

What is the advantage of Multicast mode?

Answer 15

It scales much better than unicast does.

Question 16

What mode does Cisco recommend?

Answer 16

Multicast

Question 17

What are 2 advantages of Tunnel Mode with Address Preservation

Answer 17

• Address Preservation allows the packets to take the best path
• Allows the use of ECMP

Question 18

What is a disadvantage of Address Preservation?

Answer 18

• It can’t be used on the Internet, only on private WANs and MPLS
• Incompatible with NAT