Module 19: Implement Site-to-Site IPsec VPNs

Question 1

How many steps for IPsec to establish a VPN?

Answer 1

5 Steps

Question 2

What is step 1 to establish the VPN?

Answer 2

Step 1 begins when interesting traffic is sent from host A to host B

Question 3

What is step 2 to establish the VPN?

Answer 3

IKE Phase 1 begins negotiate the ISAKMP Security associations policy

Question 4

What is step 3 to establish the VPN?

Answer 4

IKE Phase 2 begins,

Question 5

What is step 4 to establish the VPN?

Answer 5

the IPsec tunnel is created - data is transferred between the IPsec peers

Question 6

what is step 5 to establish the VPN?

Answer 6

the IPsec tunnel terminates when the SA’s are deleted.

Question 7

is GRE Unicast or Multicast Traffic

Answer 7

Multicast Traffic

Question 8

How many default ISAKMP policies are there?

Answer 8

7 default policies

Question 9

What is the most secure ISAKMP policy?

Answer 9

policy 65507

Question 10

What is the least secure ISAKMP policy?

Answer 10

policy 65514

Question 11

How to configure a new ISAKMP policy

Answer 11

remember the nemonic HAGLE for the 5 Security Associations

Question 12

What does HAGLE stand for?

Answer 12

Hash
Authentication
Group
Lifetime
Encryption

Question 13

How do you define interesting traffic?

Answer 13

When the traffic matches the ACL’s on both routers

Question 14

What is a transform set in a VPN

Answer 14

set of encryption and hashing - that will be used to transform the data through the IPsec tunnel

Question 15

What is a crypto map?

Answer 15

Crypto maps pull together the various parts configured for IPsec - such as
Where the traffic should go
What traffic should be protected by IPsec

Question 16

How many steps are there to configure a crypto map?

Answer 16

4 steps

Question 17

What is step 1 to configure a crypto map?

Answer 17

Step 1 - Bind the ACL to the map

Question 18

What is step 2 to configure a crypto map?

Answer 18

Step 2 - Specify the peers IP address

Question 19

What is step 3 to configure a crypto map?

Answer 19

Step 3 - Configure the DH group

Question 20

What is step 4 to configure a crypto map?

Answer 20

Step 4 - Configure the IPsec tunnel lifetime

Question 21

If we want IPsec to support multicast traffic what routing protocol must be used?

Answer 21

Generic Routing Encapsulation (GRE) tunnel

for the multicast traffic