複数の支店を持つグローバル組織は、オーバーレイVPNソリューションを設計するためにネットワークアーキテクトを雇いました。ブランチは頻繁に相互に通信します。顧客は、将来さらにブランチを追加することを期待しています。顧客のセキュリティ要件を満たすために、アーキテクトは動的IPsecトンネルを使用してトラフィック保護を提供することを計画しています。アーキテクトはどのソリューションを選択する必要がありますか?
正解:A
DMVPN is the correct overlay VPN solution for dynamic, secure, scalable branch-to-branch communication.
Cisco Dynamic Multipoint VPN uses multipoint GRE, NHRP, and IPsec to support dynamic tunnel creation without manually defining a static tunnel between every branch pair. That design is well suited to a global organization where branches communicate frequently and more branches will be added later. DMVPN allows spokes to register with hubs and, depending on the phase design, establish dynamic spoke-to-spoke tunnels for direct traffic while maintaining encrypted protection with IPsec. EasyVPN is more oriented to remote- access or simplified client/server VPN deployments and is not the scalable branch mesh solution described.
GETVPN is strong for private WAN encryption but does not build dynamic IPsec tunnels over an overlay in the same manner and assumes a trusted private routing core. L2TP is not the correct enterprise dynamic branch overlay. The architect should choose DMVPN and select the appropriate phase, routing protocol, summarization strategy, and IPsec profile based on branch scale and resource limits. Reference topics:
DMVPN, NHRP, mGRE, IPsec protection, spoke-to-spoke dynamic tunnels.