CCNP Routing and Switching ROUTE 300-101 Official Cert Guide (2015)

Part I. Fundamental Routing Concepts

Chapter 2. Remote Site Connectivity

This chapter covers the following subjects:

Remote Connectivity Overview: This section explains why VPNs are often a preferred method of remotely connecting to sites and identifies a collection of available VPN technologies.

MPLS VPN: This section contrasts Layer 2 MPLS VPNs and Layer 3 MPLS VPNs.

GRE: This section describes a GRE tunnel and demonstrates GRE tunnel configuration and verification.

DMVPN: This section discusses how DMVPNs can dynamically bring up connections between specific spokes in a hub-and-spoke VPN topology.

Multipoint GRE: This section explains how a single GRE interface can have connections to multiple GRE peers.

NHRP: This section explains how NHRP can discover next-hop IP addresses in networks using IP tunneling.

IPsec: This section explores how IPsec can be used to secure a VPN connection.

Traditional wide-area network (WAN) connections used technologies such as dedicated leased lines and permanent virtual circuits (PVC) defined in frame switching (for example, Frame Relay) and cell switching (for example, ATM) networks. As an example, if a company opened a remote sales office, it might have purchased a Frame Relay connection for that remote office and used a PVC that interconnected that remote office with the corporate headquarters.

However, with the current state of the Internet, high-speed connections are widely accessible. For example, a remote sales office might purchase a DSL or cable modem connection to the Internet, at a relatively low cost as compared to traditional leased lines or frame/cell switching technologies. Over that Internet connection, a virtual private network (VPN) could create a logical path between the sales office and the headquarters location.

The theory and configuration of VPNs goes well beyond what is covered in this chapter; however, the ROUTE exam blueprint only requires configuration knowledge for Generic Routing Encapsulation (GRE) tunnels. Therefore, this chapter will help you understand the theory of multiple VPN technologies, while showing the configuration and verification of GRE.

“Do I Know This Already?” Quiz

The “Do I Know This Already?” quiz allows you to assess whether you should read the entire chapter. If you miss no more than one of these seven self-assessment questions, you might want to move ahead to the “Exam Preparation Tasks” section. Table 2-1 lists the major headings in this chapter and the “Do I Know This Already?” quiz questions covering the material in those headings so that you can assess your knowledge of these specific areas. The answers to the “Do I Know This Already?” quiz appear in Appendix A.

Table 2-1 “Do I Know This Already?” Foundation Topics Section-to-Question Mapping

1. Which of the following is a valid design consideration for a hybrid VPN?

a. You cannot encapsulate an encrypted packet.

b. You cannot encrypt an encapsulated packet.

c. You might need to decrease the MTU size for frames on an interface.

d. You might need to increase the MTU size for frames on an interface.

2. In a Layer 3 MPLS VPN, with what does a CE router form a neighborship?

a. A PE in the MPLS network.

b. A CE at a remote location.

c. No neighborship is formed, because the MPLS network acts as a logical switch.

d. No neighborship is formed, because IP multicast traffic cannot be sent across an MPLS network.

3. You want to interconnect two remote sites with a VPN tunnel. The tunnel needs to support IP unicast, multicast, and broadcast traffic. Additionally, you need to encrypt traffic being sent over the tunnel. Which of the following VPN solutions meets the design requirements?

a. Use a GRE tunnel.

b. Use an IPsec tunnel.

c. Use a GRE tunnel inside of an IPsec tunnel.

d. Use an IPsec tunnel inside of a GRE tunnel.

4. Identify technologies required for a DMVPN network. (Choose three.)

a. NHRP

b. IPsec

c. MPLS

d. mGRE

5. Which of the following are characteristics of multipoint GRE? (Choose two.)

a. mGRE supports a wide variety of protocols.

b. A single mGRE interface can service multiple tunnels.

c. An mGRE interface is created for each tunnel.

d. mGRE only transports unicast IP packets.

6. Which of the following are true for NHRP? (Choose two.)

a. The hub router is configured with the IP addresses of the spoke routers.

b. The spoke routers are configured with the IP address of the hub router.

c. Spoke routers query the hub router asking what tunnel interface IP address corresponds to a known physical interface IP address.

d. Spoke routers query the hub router asking what physical interface IP address corresponds to a known tunnel interface IP address.

7. Which IPsec feature primarily performs encryption?

a. Integrity

b. Confidentiality

c. Antireplay

d. Authentication

Foundation Topics

Remote Connectivity Overview

The voice, video, and data commonly sent between remote offices and central sites often demand low latency and easy provisioning, all while maintaining a low cost. Traditional WAN solutions (for example, leased lines, Frame Relay, and ATM) typically fail to simultaneously meet all these requirements. Fortunately, a variety of VPN technologies fit nicely into such a design.

This section categorizes various VPN technologies. Then, the remainder of this chapter examines these technologies in a bit more detail.

MPLS-Based Virtual Private Networks

Multiprotocol Label Switching (MPLS) is a technology commonly used by service providers, although many large enterprises also use MPLS for their backbone network. MPLS makes forwarding decisions based on labels rather than IP addresses. Specifically, a 32-bit label is inserted between a frame’s Layer 2 and Layer 3 headers. As a result, an MPLS header is often called a shim header, because it is stuck in between two existing headers.

MPLS-based VPNs can be grouped into one of two primary categories:

Layer 2 MPLS VPNs

Layer 3 MPLS VPNs

These two approaches are discussed further in the section “MPLS VPN,” later in this chapter.

Tunnel-Based Virtual Private Networks

A tunnel is a virtual connection that can physically span multiple router hops. However, from the perspective of the traffic flowing through the tunnel, the transit from one end of a tunnel to the other appears to be a single router hop.

Multiple VPN technologies make use of virtual tunnels. A few examples discussed in this chapter include

Generic Routing Encapsulation (GRE)

Dynamic Multipoint VPN (DMVPN)

Multipoint GRE

IPsec

Hybrid Virtual Private Networks

Rather than just using a single MPLS-based VPN technology or a single tunnel-based VPN technology, you can use select VPN technologies in tandem. For example, you might want to extend an MPLS network at one corporate location to MPLS networks at remote corporate locations, while having a requirement that traffic traveling through a service provider’s cloud be encrypted.

You could meet the requirements of such a design by having a Layer 3 MPLS VPN set up over a DMVPN. The DMVPN technology carrying the Layer 3 MPLS VPN traffic allows you to efficiently set up direct links between corporate locations, and it also allows you to use IPsec, which can encrypt the traffic flowing through the service provider’s cloud.

When it comes to hybrid VPNs, a significant design consideration is overhead. Every time you add an encapsulation, you are adding to the total header size of the packet. With more headers, the amount of data you can carry inside a single packet is decreased. As a result, you might have to configure a lower maximum transmission unit (MTU) size for frames on an interface.

MPLS VPN

MPLS VPNs extend the capabilities of MPLS, supporting VPNs created across an MPLS network. These VPNs, most commonly found in service provider or large enterprise networks, can be categorized as either Layer 2 MPLS VPNs or Layer 3 MPLS VPNs.

Layer 2 MPLS VPN

With a Layer 2 MPLS VPN, the MPLS network allows customer edge (CE) routers at different sites to form routing protocol neighborships with one another as if they were Layer 2 adjacent. Therefore, you can think of a Layer 2 MPLS VPN as a logical Layer 2 switch, as depicted in Figure 2-1.

Figure 2-1 Logical View of a Layer 2 MPLS VPN

Layer 3 MPLS VPN

With a Layer 3 MPLS VPN, a service provider’s provider edge (PE) router (also known as an Edge Label Switch Router [ELSR]) establishes a peering relationship with a CE router, as seen in Figure 2-2. Routes learned from the CE router are then sent to the remote PE router in the MPLS cloud (typically using multiprotocol BGP [MP-BGP]), where they are sent out to the remote CE router.

Figure 2-2 Layer 3 MPLS VPN

GRE

As its name suggests, a Generic Routing Encapsulation (GRE) tunnel can encapsulate nearly every type of data that you could send out of a physical router interface. In fact, GRE can encapsulate any Layer 3 protocol, which makes it very flexible.

GRE by itself does not provide any security for the data it transmits; however, a GRE packet can be sent over an IPsec VPN, causing the GRE packet (and therefore its contents) to be protected. Such a configuration is commonly used, because IPsec can only protect unicast IP packets. This limitation causes issues for routing protocols that use IP multicasts. Fortunately, a GRE tunnel can encapsulate IP multicast packets. The resulting GRE packet is an IP unicast packet, which can then be protected by an IPsec tunnel.

As an example, consider Figure 2-3. Routers R1 and R2 need to form an Open Shortest Path First (OSPF) neighborship across the service provider’s cloud. Additionally, traffic between these two routers needs to be protected. While IPsec can protect unicast IP traffic, OSPF communicates through IP multicasts. Therefore, all traffic between Routers R1 and R2 (including the OSPF multicasts) is encapsulated inside of a GRE tunnel. Those GRE packets, which are unicast IP packets, are then sent across, and protected by, an IPsec tunnel.

Figure 2-3 GRE over IPsec Tunnel