Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CCNP-ENCOR > Overlay Technologies > Flashcards

Overlay Technologies Flashcards

1
Q

What is an overlay network

A

is a logical/virtual network built on top of a physical (underlay) network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the most popular overlay technologies

A

GRE
IPsec
LISP
VXLAN
MPLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is one of the most common problems with overlay tunnels

A

Recursive routing - the tunnel destination was learnt through the tunnel itself via IGP. this is solved by removing the internet facing interface from the IGP routing protocol.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a VPN

A

When 2 private networks are connected across an unsecure network. to send secure traffic across an unsecure network IPsec is used as an encryption framework suite of protocols.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is GRE and what are its uses

A

Generic routing encapsulation is a protocol used to encapsulate traffic across an IP network.

Uses:
Initially used to route non IP traffic across IP networks.
used to tunnel traffic through a firewall
Connect discontiguous networks together
duct tape bad routing designs
VPNs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What protocol number does GRE use

A

47

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Why define bandwidth on a GRE tunnel

A

For routing protocol metric calculations and QoS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

By default the line protocol on a GRE tunnel is down if there is no route to the destination in the RIB.

True or False

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is IPsec

A

It is a series of standards for creating secure VPNs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the main security services provided by IPsec

A

Peer authentication - using PSK/ certificates
Data confidentiality - Encryption (AES,DES)
Data integrity - Hashing (MD5,SHA-1)
Relay detection - packet sequencing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the 2 types of IPsec headers

A

Authentication header
Encapsulating Service Payload (ESP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the major drawback of authentication header

A

encryption is not supported

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What protocol number does authentication header use

A

number 51

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the 2 modes for ESP and what is the difference

A

Tunnel mode - encrypts the entire packet by placing IPsec header on to the packet. the IPsec header is used to route.

Transport mode - encrypts only packet payload it will use the original IP header to route across the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What protocol number does ESP use

A

50

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is Diffie-Hellman (DH)

A

DH is an asymmetric key exchange protocol that allows 2 peers to exchange secret keys. It is done by exchanging public keys and using there own private key 2 keys are made independently that are the same and encrypt the data the same so it can be de-crypted the same.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What DH groups should not be used and which should be used

A

bad - 1,2 & 5
good - 14 and above

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is an RSA signature

A

is a public key that is used to mutually authenticate peers. (digital certificate)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a transform set

A

it is a configured attribute that defines the security parameters for the IPsec SA negotiation including: security protocol, encryption & authentication algorithms.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is IKE

A

Is a protocol used to establish a secure authenticated session between 2 endpoints and use the session to negotiate session keys and parameters for an IPsec tunnel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How many versions of IKE are there and what is the main differences

A

2

V1 is used in legacy network infrastructure.

v2 supports EAP has anti-DOS capabilities and requires fewer messages to establish an SA.

21
Q

In IKE what is Phase 1 & Phase 2

A

Phase 1 - start of the negotiation, the 2 end points are agree on SA (authentication, hash, etc..) and authenticate against each other.

Phase 2 - In this phase the endpoints will agree on the SAs for the bulk data transfer.

Phase 1 takes longer to build and once built remains however a phase 2 tunnel will only be built if interesting traffic is required to be sent.

22
Q

In IKEv1 what are the 2 methods for building the phase 1 tunnel (IKE-SA)

A

Main Mode (MM)
Aggressive Mode (AM)

23
Q

What is the difference in IKEv1 MM and AM

A

MM uses 6 messages to form IKE-SA
AM uses 3 messages to form IKE-SA

MM is slower but a lot more secure due to the IKE peers identity been hidden.

AM is faster and more efficient but less secure.

24
Q

In IKE v1 MM what are the different messages for

A

MM1 - initiator sends SA parameters to match against.
MM2 - responder responds to MM1 with SA parameters that it has matched.
MM3 - DH key exchange
MM4 - DH key response
MM5 - authentication session started, IP revealed.
MM6 - authentication session completed. IKE-SA formed

25
Q

IN IKEv1 what are the messages used in AM

A

AM1- message includes all SA parameters and starts authentication session.

AM2 - DH key exchange completed and authentication completed.

AM3 - Authentication completed

26
Q

In IKEv1 Phase 2 what messages are sued to establish the IPsec-SA tunnel

A

QM1 - initiator confirms agreed SAs in phase 1 then sends SAs for bulk traffic to e sent.

QM2 - response matching the IPsec SA parameters.

QM3 - After this message IPsec SA is complete.

27
Q

What is Perfect Forward Secrecy (PFS)

A

Where the DH keys are derived independently of the previous keys to prevent further keys been computed if compromised.

28
Q

IKEv2 main difference is that SA’s are established through request/response message pairs.

True / False

A

True.

29
Q

What are the different request / response pairs

A

IKE_SA_INIT - SA proposals matched and DH keys exchanged.
IKE_SA_AUTH - Session authenticated. following this IKE-SA & Child SA are created.

30
Q

What is the minimum amount of messages for IKEv1 (MM), IKEv1 (AM) & IKEv2

A

9,6,4

31
Q

What port and transport mechanism does IKE use

A

UDP 500

32
Q

What are the different types of VPN configurations

A

Site-to-site
Cisco DMVPN - hub to spoke set up
Cisco GET VPN - any-to-any tuneless vpn
Cisco FLEX VPN - cisco version of IKEv2
Cisco remote VPN

33
Q

What are the 2 site-to-site VPN configuration methods called

A

site-to-site GRE over IPsec
Static virtual interfaces (VTI) over IPsec

34
Q

What is the main difference between site-to-site GRE over IPsec and Static VTI VPNs

A

site-to-site GRE over IPsec uses crypto maps and ACLs

Static VTI VPN uses IPsec policy (ISKAMP profile)

35
Q

Why are crypto maps bad

A

complex config
Does not support MPLS natively
ACl’s often misconfigured
Maps often consume a lot of TCAM space.

36
Q

When configuring crypto IPsec profiles what is the only difference in config between the site to site and static VTI

A

use command tunnel mode ipsec ipv4/ipv6 under tunnel interface.

37
Q

What is CISCO LISP

A

Is a routing architecture that separates the Identity of a host and there location into 2 separate IP’s. The EID is the identity of the host, the RLOC is the location of the router to which the EID is attached.

38
Q

What was LISP brought in to solve

A

Large routing tables on the internet cause:

Aggregation issues - due to most routes on the internet been provider independent they are not aggregated on the internet.

Traffic engineering - traffic engineering injects more specific routes.

Multi-homing - requires full internet routing table.

Route instability - constant change causes ‘churn’ of routes.

39
Q

Why is LISP better than traditional routing like OSPF, EIGRP, BGP?

A

Tradtional routing protocols rely on a push model where the routes are pushed onto the routers.

LISP works on a pull model it asks for specific routes that it requires.

resulting in less bandwidth usage.

40
Q

What port does LISP use

A

UDP 4341

41
Q

What is a Ingress/ egress tunnel router (I/ETR)

A

A router that encapsulates/de-encapsulates the IP packet.

42
Q

What is a Map server (MS)

A

Learns and stores EID to RLOC associations

43
Q

What is a Map resolver (MR)

A

receives and resolves LISP requests.

44
Q

What is the process for a new LISP registration

A

ETR sends a map register message to the MS to register associated EID and prefix to the RLOC.

MS sends a notify message to ETR to confirm map registry has been received and processed.

45
Q

What is VXLAN

A

a tunnelling protocol that encapsulates layer 2 ethernet traffic over a layer 3 IP network.

46
Q

What is a VNI

A

VXLAN Network Identifier, it identifies the VXLAN segment similar to a VLAN.

24-bit number that has over 16 million VXLAN’s

47
Q

What is a VTEP

A

VXLAN Tunnel endpoint, is a device responsible for encapsulating/de-encapsulating layer 2 ethernet traffic.

This device is the connection between the underlay and overlay network.

48
Q

VTEPs can either be software based (using hyper visors)

or Hardware based

True or False

A

True

49
Q

What are the 2 VTEP interfaces used for

A

VTEP IP interface - connects the VTEP to the underlay netwrok, this interface encapsulates and de-encapsulates traffic.

VNI Interface - a virtual interface that keeps traffic separated from the physical interface (Similar to a SVI)

50
Q

What are the VXLAN control plane operation methods

A

Multicast underlay
static unicast VXLAN tunnels
MP-BGP EVPN
LISP

CCNP-ENCOR (17 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions