A city clerk’s office runs DMVPN over Internet transports and must…

Question

A city clerk’s office runs DMVPN over Internet transports and must encrypt mGRE overlay traffic. What mechanism binds that encryption to the tunnels?

Accepted Answer

Applying an IPsec profile (tunnel protection) to the mGRE tunnel so overlay packets are encrypted and authenticated — mGRE over the Internet without IPsec is a postcard; with an IPsec profile it becomes a sealed envelope. Tunnel protection binds the crypto to the DMVPN tunnel interface. EXP tricks and PHP do not encrypt the overlay for the city clerk.

Answer

Exporting MPLS EXP bits into GRE keys so P routers encrypt spoke packets

Answer

Enabling PHP on the hub so cleartext mGRE is popped before Internet egress

Answer

Advertising VPNv4 routes over the tunnel to imply IPsec without a crypto map or profile

A city clerk’s office runs DMVPN over Internet transports and must encrypt mGRE overlay traffic. What mechanism binds that encryption to the tunnels?

Short Explanation

Full Explanation