Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cisco CCNP ENCOR > Overlay Tunnels Theory > Flashcards

Overlay Tunnels Theory Flashcards

VPN, LISP, VXLAN

1
Q

What is the protocol number for GRE?

A

Protocol 47

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

When a router encapsulates a packet for GRE, what is added to the packet?

A

A GRE header and GRE flags are added to the packet. The GRE header contains the remote endpoint IP address as the destination.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

When configuring a point to point GRE tunnel, what 4 configuration elements are required?

A
  1. Tunnel interface id
  2. Tunnel IP address
  3. Tunnel source
  4. Tunnel destination
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Why might you need to adjust the MTU size for the tunnel interface?

A

GRE encapsulation adds 24 bytes (minimum) to the packet size. It may be desired to control packet fragmentation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is IPSec?

A

IPsec is a framework of open standards for creating highly secure virtual private networks (VPNs) using various protocols and technologies for secure communication across unsecure networks, such as the Internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What four security services does IPSec Provide?

A
  1. Peer Authentication (Certificates, Pre-shared Key)
  2. Data Confidentiality (Encryption)
  3. Data Integrity - Hashing to prevent MitM attacks
  4. Replay detection - marking packets with sequence numbers to prevent MitM attacks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What protocol number identifies the IPSec Authentication header?

A

Protocol 51

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What protocol number identifies the IPSec Encapsulating Security Payload (ESP)

A

Protocol 50

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What Security Services are provided by the IPSec Authorization Header?

A

Data integrity, authentication, replay detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What additional Security Services are provided by IPSec ESP?

A

Encryption of payload and headers (confidentiality). Support for encryption over NAT.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the difference between IPSec Transport Mode and Tunnel Mode?

A

Tunnel mode encrypts the entire packet including the packet headers. Transport mode only encrypts the packet’s payload.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

List the encryption, hashing, and keyring methods supported by IPSec

A
  • Data Encryption Standard (DES)
  • Triple DES (3DES)
  • Advanced Encryption Standard (AES)
  • Message Digest 5 (MD5)
  • Secure Hash Algorithm (SHA)
  • Diffie Helman (DH)
  • RSA Signatures
  • Pre-Shared Key
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is ISAKMP?

A

Internet Security Association Key Management Protocol (ISAKMP) is a framework for authentication and key exchange between two peers to establish, modify, and tear down SAs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What improvements does IKEv2 make over IKEv1?

A
  • Reduces the number of messages that need to be exchanged
  • Uses Elliptical Curve Digital Signature Algorithm (ECDSA-SIG) instead of public keys
  • Extensible Authentication Protocol (EAP)
  • Next Generation Encryption
  • Asymmetric Authentication
  • Anti-DoS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Name the VPN Types that are supported on a Cisco Router

A
  • Site-to-Site IPSec VPN
  • Cisco DMVPN (Dynamic Multipoint)
  • Cisco Group Encrypted Transport (GET) VPN
  • Cisco FlexVPN
  • Remote VPN (FlexVPN)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Why should IPSec profiles be used instead of Crypto Maps when configuring IPSec tunnels?

A

Crypto Maps have limitations such as:
- Cannot natively support MPLS
- Can become overly complex
- Crypto ACLs are easily misconfigured
- Cryto ACL entries consume too much memory

17
Q

What is LISP?

A

Locator ID Separation Protocol - a Cisco routing architecture and data control plane that was created to address routing scalability over the Internet.

18
Q

What two networking entities are separated by LISP?

A
  • Location (Subnet)
  • Identity (IP Address)

You can take a subnet and physically spread it across multiple Layer 2 switches.

19
Q

What port is used by LISP?

A

UDP Port 4341

20
Q

In LISP what are the terms ETR, ITR and xTR.

A

Egress Tunneling router (end of the LISP tunnel), Ingress Tunneling Router, Tunnel Router (xTR). An xTR is a general term for both an ETR and an ITR.

21
Q

In LISP what are the MS and the MR?

A

Map Server - This is a network device (typically a router) that learns EID-to-prefix mapping entries from an ETR and stores them in a local EID-to-RLOC mapping database.

Map Resolver - This is a network device (typically a router) that receives LISP-encapsulated map requests from an ITR and finds the appropriate ETR to answer those requests by consulting the map server.

MS/MR - when both roles are on the same device

22
Q

In LISP what are the PITR, PETR, and xPTR?

A

xPRT - Proxy Tunnel router - a LISP router that connects to a non-LISP external envrionment
PITR - Proxy Ingress Tunnel Router
PETR - Proxy Egress Tunnel Router

23
Q

In LISP what are the EID and RLOC?

A

EID - Endpoint Identifier - the IP address of the LISP endpoint (ITR). In most cases this is a subnet for a LISP domain attached network.

RLOC - Routing Locator - the IP address of the LISP ETR

24
Q

What headers are added to an IP packet when its encapsulated with LISP?

A

Additional Destination IP Address header (RLOC), UDP port (4341), LISP header -> original packet header/payload

25
Q

What device sends a “map register” message and what happens within the LISP domain when the map register is sent?

A

The map register is sent from the ETR advertising an attached subnet (RLOC). The message is sent to the Map Server which then records an EID to RLOC mapping in its database.

26
Q

When an ITR sends a map request, describe the order of events that follow.

A

1.) ITR sends map request to Map Resolver (MR)
2.) Map Resolver sends request to Map Server (MS)
3.) Map Server forwards the map request to ETR
4.) ETR sends a map reply to the ITR

27
Q

What happens when an ITR sends a map request and the Map Server does not have EID to RLOC mapping in its database for the network prefix?

A

The Map Server responds with a “negative” message and the ITR will then send the packet to the Proxy Tunnel Router.

28
Q

What is VXLAN?

A

Virtual Extensible Local Area Network - a tunneling protocol that functions at Layer 2

29
Q

What scalability issues does VXLAN set out to resolve?

A
  • Limited number of VLANs
  • Segmentation with Private VLANs
  • Reliance on STP
30
Q

How many possible VLANs are possible with VXLAN?

A

Over 16 million

31
Q

What are the size of the additional VXLAN headers that need to be considered when adjusting for Max MTU?

A

Outer IP Header - 20 bytes
UDP Header - 8 bytes
VXLAN Header - 8 bytes
Encapsulated (original) Ethernet header - 14 bytes + 4 bytes VLAN tag

Total: 54 bytes

Note: VLAN tag (4 bytes) can be placed into VXLAN header to reduce it to 50 bytes

32
Q

in VXLAN, what is a VTEP?

A

Virtual Tunnel Endpoint - entities that originate or terminate a VXLAN tunnel.

33
Q

Which two Cisco solutions leverage VXLAN?

A

Software Defined Access (SDA) and Application Centric Infrastructure (ACI)

Cisco CCNP ENCOR (22 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions