An organization standardizing on IKEv2 wants one Cisco configuration framework it can use for site-to-site, hub-and-spoke, spoke-to-spoke, and remote access VPNs instead of maintaining separate technologies. Which framework fits?
Select an answer to reveal the explanation.
Short Explanation
Why would you keep a separate toolbox for every job when one tool can flex? FlexVPN is Cisco's IKEv2-based framework that handles site-to-site, hub-and-spoke, spoke-to-spoke, and remote access with one consistent model. The trap is Easy VPN — it's an older IKEv1 remote-access tool.
Full Explanation
FlexVPN is Cisco's unified VPN framework built entirely on IKEv2. It uses a common set of building blocks, including IKEv2 proposals, policies, profiles, keyrings, and virtual tunnel interfaces, to implement point-to-point, hub-and-spoke, spoke-to-spoke through NHRP shortcut switching, and remote access designs. Because it relies on IKEv2, it inherits features such as built-in NAT traversal, EAP-based remote user authentication, and configuration exchange that pushes routes and addresses to peers. Standardizing on it lets one team maintain a single configuration model rather than separate crypto maps, DMVPN, and remote access constructs. GETVPN uses GDOI rather than IKEv2 group keys, and it is a tunnel-less design for private WANs that does not provide remote access. DMVPN is not limited to IKEv1 and is a specific overlay technology rather than a unified framework for remote access as well. Easy VPN is a legacy remote access and branch solution built on IKEv1 and does not provide the IKEv2-based unified model. Exam caveat: FlexVPN interoperates with standards-based IKEv2 peers for basic site-to-site tunnels, while some advanced features remain Cisco-specific. Operational check: verify that IKEv2 security associations establish for each topology and that virtual access interfaces are created for dynamic spokes and remote users.