16. Overlay Tunnels Flashcards
What is GRE (Generic Routing Encapsulation)?
A tunneling protocol that provides connectivity to a wide variety of network-layer protocols by encapsulating and forwarding packets over an IP-based network.
What was GRE originally created for?
To provide transport for non-routable legacy protocols such as IPX
What is added for the encapsulation of GRE?
An extra header with the remote endpoints IP
What are the command needed to establish a tunnel?
Interface tunnel
Tunnel source
Tunnel destination
IP address
What are the optional commands needed to establish a tunnel?
Bandwidth
Keepalive
IP mtu
What is the size of the GRE header?
Minimum 24 bytes
What is recursive routing?
This occurs when a router has a next hop that is not directly connected
Hoe can recursive routing be solved?
By adding a static route
What is IPsec?
A framework of open standards for creating highly secure VPNs
What are the security services for IPsec?
- Peer authentication
- Data confidentiality
- Data integrity
- Replay detection
What are the 2 packet headers of IPsec?
- Authentication header
- Encapsulating Security Payload (ESP)
What does ESP do?
It provides ecryption for the payload and adds a header
What are the 2 modes of packet transport for IPsec?
- Tunnel mode
- Transport mode
What is the difference between tunnel and transport mode?
Tunnel encrypts the complete packet and supports NAT-T
What are the 8 encryption methods IPsec supports?
- DES
- 3DES
- AES
- MD5
- SHA
- DH
- RSA signature
- Pre-Shared key
What is IKE?
The Internet Key Exchange is a protocol that performs authentication between 2 endpoints to establish security associations (ASs). Known as IKE tunnels
What are the two phases of key negotiation for IKE and IPsec?
- Phase 1: Establishes a bidrectional SA between two IKE peers. Both peers can negotiate for phase 2
- Phase 2: Establishes unidirectional IPsec SA
What are the two modes for phase 1?
- Main mode
- Aggresive mode
What are the 5 IPsec VPN solutions?
- Site-to-site
- DMVPN
- GET-VPN
- FlexVPN (combines all
- Remote Access VPN
What is LISP?
A routing architecture and a data & control plane protocol that was created to address routing scalability problems on the internet
What is an EID?
The IP address of an endpoint within a LISP site
What is an ITR?
LISP router that LISP-encapsulate IP-packets coming from EIDs that are destined outside the LISP site
What is an ETR?
LISP router that LISP-deencapsulate IP-packets coming from sites outside the LISP site and destined to EIDs within the LISP site
What is an xTR?
A tunnel router that performs ETR and ITR functions
