User VPN

Question 1

5 principles of Aviatrix User VPN

Answer 1

1 - Connect users to public cloud resources
2 - Cloud native (not backhaul to on-prem DC first)
3 - Least latency access
4 - enterprise grade: identity provider intergration
5 - multi-cloud repeatability

Question 2

What clients are supported with Aviatrix User VPN

Answer 2

OpenVPN

Aviatrix VPN

Question 3

Aviatrix VPN client is preferred when?

Answer 3

• Client has MacOs, Windows, Linux or BSD

- require SAML authentication directly from VPN client software

Question 4

Aviatrix User VPN Automates …..

Answer 4

Launch cloud native loadbalancer
automate target groups to attache VPN gateways to LB
domain name of the vpn endpoint
connection ip created for .ovpn cert file to provide to clients
seemless relaunch of VPN gateways ofter deletion without reissue new .ovpn files (same IP)

Question 5

A profile can be __________ with multiple users

Answer 5

associated

Question 6

a user can be _________ with multiple profiles

Answer 6

associated

Question 7

security based on use not _______

Answer 7

source IP

Question 8

supports _______ profiles

Answer 8

multiple

Question 9

__________ firewall rules

Answer 9

Automates

Question 10

Geo VPN usage:

Answer 10

dynamically route VPN users to nearest Aviatrix VPN gateway based upon latency between user and gateways
users directed to AWS Route 53/Azure DNS that uses latency based routing policy OR choose between available regions

Question 11

Default User VPN CIDR Block

Answer 11

192.168.43.0/24

Question 12

Client Certificate Sharing facets

Answer 12

Disabled by default
Multiple users share same ovpn file
only used when authenticating with IDP
controller sess individual users, maintains history

Question 13

How to preserver Client IP

Answer 13

VPN NAT must be disabled

VPN CIDRs must be advertised to transit for return traffic

Question 14

PBR stands for?

Answer 14

Policy Based Routing

Question 15

Reasons to use PBR Routing

Answer 15

Route VPN traffic via different gateway
anonymous web surfing
backhauling user traffic to cloud firewalls

Question 16

user VPN client connection options

Answer 16

1 - Enforce minimum VPN client version

2 - Duplicate connections (disable for single connection policy)

Question 17

To segment VPN users, tunnel access can be _______ OR _______

Answer 17

Split Tunnel (specify certain CIDRs)
Full Tunnel - All user IP sessions including Internet IP sessions go thru VPN tunnel

Question 18

Aviatrix UserVPN authentication supports SAML …

Answer 18

Secure assertion markup language
support IDPs like Azure AD, Okta, Duo, Office365
user accounts onboarded on the IDP portal
users can be onboarded on Aviatrix if SAML is NOT required

Question 19

FQDN Egress Filtering types (3)

Answer 19

HTTP - support wildcards
HTTPS - support wildcard after analyzing Server Name Identification in TLS
Other TCP/UDP, SFTP/SSH - does not support wildcards

Question 20

Egress FQDN filtering facets

Answer 20

HA secure for workloads or applications
centrally managed by controller
Filters internet bound egress traffic from workloads
filter tcp/udp traffic
filter destination host names allow/deny list
support wildcard and tags
supports instance in public/private subnets