GRE & IPsec Tunnels Practice Questions

Answers and explanations appear when you work through the set above.

1. Which commonly used conservative tunnel MTU can reduce fragmentation when GRE and IPsec overhead is added over a 1500-byte WAN path?

   • 1500 bytes
   • 1400 bytes
   • 1524 bytes
   • 1300 bytes

2. Which GRE feature enables a hub router to dynamically establish point-to-multipoint GRE tunnel paths to multiple spoke routers using a single logical tunnel interface?

   • IPsec static Virtual Tunnel Interface (sVTI)
   • Multipoint GRE (mGRE)
   • 802.1Q-in-802.1Q tunneling (QinQ)
   • Layer 2 Tunneling Protocol v3 (L2TPv3)

3. What occurs when GRE tunnel keepalives fail repeatedly on a Cisco IOS router interface?

   • The tunnel line protocol goes down (up/down), so routes that use the tunnel are withdrawn.
   • The underlying physical interface is reset automatically to recover the transport path.
   • The tunnel stays up/up but silently drops all payload packets arriving from the peer.
   • The router switches tunnel traffic to a fallback NAT translation through the physical link.

4. How many bytes of header overhead does a standard cleartext IPv4 GRE tunnel add to an encapsulated IP packet?

   • 8 bytes
   • 24 bytes
   • 12 bytes
   • 40 bytes

5. In IPsec architecture, what is the role of the initial IKEv2 exchange?

   • Encrypt user data packets directly with SHA-256 before any security association exists.
   • Build the authenticated IKE SA and the first Child SA for data traffic.
   • Assign tunnel IP addresses to peers dynamically using DHCP carried over GRE.
   • Build multicast distribution trees between the peers using PIM sparse mode.

6. What is the standard header byte overhead introduced by a basic (non-IPsec) Generic Routing Encapsulation (GRE) tunnel encapsulated within an IPv4 packet?

   • 8 bytes
   • 12 bytes
   • 24 bytes
   • 50 bytes

7. Why is Encapsulating Security Payload (ESP) preferred over Authentication Header (AH) in modern IPsec VPN implementations?

   • ESP carries multicast natively without a GRE or VTI tunnel, whereas AH can only protect unicast traffic.
   • ESP adds encryption (confidentiality) on top of integrity and authentication; AH does not encrypt.
   • AH passes cleanly through NAT and PAT devices, whereas ESP cannot traverse NAT even with NAT-T.
   • ESP is processed entirely in hardware on every platform, so it adds no CPU load compared with AH.

8. What operational issue is resolved by configuring IPsec Dead Peer Detection (DPD)?

   • It removes the need to exchange RSA public keys between peers during IKE Phase 1 negotiation.
   • It detects a dead IKE peer quickly so traffic is not sent into a black-holed IPsec tunnel.
   • It prevents TCP window scaling problems on high-latency satellite links carrying the tunnel.
   • It translates IPv4 IPsec headers into native IPv6 headers at the tunnel endpoints.

9. How does configuring keepalive <interval> <retries> on a point-to-point GRE tunnel interface allow a router to detect transport failure?

   • It sends a GRE-encapsulated packet that the peer returns; missed replies bring the tunnel down.
   • It sends ICMP echo requests to the remote site's DNS resolvers and tracks their response time.
   • It disables auto-negotiation on the physical interface so a link failure is detected faster.
   • It opens an iBGP session on TCP port 179 to the tunnel's far end and watches the BGP hold timer.