Cisco CCNA Preparation · lesson 32 of 36 · 25 min
VPN Overview
A VPN (Virtual Private Network) creates an encrypted, private tunnel over a public network (the internet). It allows remote sites and users to communicate securely as if they were on the same private network.
The CCNA covers three VPN technologies: GRE tunnels (encapsulation without encryption), DMVPN (scalable site-to-site VPN), and SSL/TLS VPN (remote access for individual users).
GRE Tunnels
GRE (Generic Routing Encapsulation) creates a virtual point-to-point link between two routers over any network. It encapsulates packets inside a GRE header and an outer IP header — allowing routing protocols (OSPF, EIGRP) to run over the tunnel.
Important: GRE alone provides NO encryption. It is often combined with IPsec to add security (GRE over IPsec).
GRE overhead
GRE adds 24 bytes of overhead (20-byte IP header + 4-byte GRE header). This reduces the effective MTU. Set ip mtu 1476 and ip tcp adjust-mss 1436 on the tunnel interface to prevent fragmentation.
DMVPN — Dynamic Multipoint VPN
DMVPN is a Cisco solution for scalable hub-and-spoke and spoke-to-spoke VPN. It uses three technologies: mGRE (multipoint GRE — one tunnel interface supports multiple peers), NHRP (Next Hop Resolution Protocol — maps tunnel IPs to physical IPs dynamically), and IPsec (encryption).
In traditional hub-and-spoke VPN, spoke-to-spoke traffic must go through the hub. DMVPN Phase 3 allows spokes to build direct tunnels to each other on demand — reducing latency and hub load.
SSL/TLS VPN — Remote Access
SSL/TLS VPN (also called clientless VPN or AnyConnect VPN) provides remote access for individual users over HTTPS. Unlike IPsec VPN, it requires no pre-installed VPN client for basic access — users connect via a web browser.
Knowledge Check — 10 Questions
GRE Tunnels, DMVPN, SSL/TLS VPN
What does GRE provide that IPsec alone does not?
- Encryption
- The ability to carry multicast and routing protocol traffic inside the tunnel
- Authentication
- Faster throughput
Answer: The ability to carry multicast and routing protocol traffic inside the tunnel
GRE encapsulates any Layer 3 protocol including multicast, allowing routing protocols (OSPF, EIGRP) to run over the tunnel. IPsec alone only carries unicast IP traffic.
Does GRE provide encryption?
- Yes — GRE encrypts all tunnel traffic
- No — GRE provides encapsulation only; IPsec must be added for encryption
- Only for IPv6 traffic
- Only when combined with DMVPN
Answer: No — GRE provides encapsulation only; IPsec must be added for encryption
GRE is encapsulation only — no encryption, no authentication. Combine with IPsec (GRE over IPsec) to add security.
What command sets the remote endpoint of a GRE tunnel?
- tunnel source
- tunnel destination
- tunnel endpoint
- ip tunnel remote
Answer: tunnel destination
tunnel destination [IP] specifies the public IP address of the remote router. tunnel source specifies the local interface or IP that sends tunnel packets.
What three technologies does DMVPN combine?
- GRE, OSPF, IPsec
- mGRE, NHRP, IPsec
- GRE, BGP, SSL
- VXLAN, NHRP, TLS
Answer: mGRE, NHRP, IPsec
DMVPN = mGRE (multipoint GRE — one interface, many peers) + NHRP (maps tunnel IPs to physical IPs) + IPsec (encryption). Together they enable scalable, dynamic VPN.
In DMVPN Phase 3, how does spoke-to-spoke traffic flow?
- Always through the hub
- Direct dynamic tunnels between spokes on demand
- Through a dedicated spoke-to-spoke server
- Via BGP route reflectors
Answer: Direct dynamic tunnels between spokes on demand
DMVPN Phase 3 allows spokes to build direct tunnels to each other when needed, bypassing the hub. This reduces latency and hub bandwidth consumption.
What port does SSL/TLS VPN use, and why is this advantageous?
- UDP 500 — fast
- TCP 443 — passes through most firewalls as HTTPS traffic
- TCP 1194 — OpenVPN standard
- UDP 4500 — NAT traversal
Answer: TCP 443 — passes through most firewalls as HTTPS traffic
SSL VPN uses TCP 443 (HTTPS). Most firewalls allow outbound 443 traffic, making SSL VPN accessible from hotels, coffee shops, and restrictive networks where IPsec (UDP 500/4500) may be blocked.
What is clientless SSL VPN?
- A VPN that requires no server
- Browser-based VPN access — no client software needed; accesses web apps through a portal
- A VPN with no encryption
- A VPN for IoT devices
Answer: Browser-based VPN access — no client software needed; accesses web apps through a portal
Clientless SSL VPN uses a web browser to access the VPN portal. Users can reach internal web apps and file shares without installing VPN software.
Why is ip tcp adjust-mss configured on a GRE tunnel interface?
- To increase tunnel throughput
- To prevent TCP fragmentation caused by GRE overhead reducing the effective MTU
- To enable OSPF over the tunnel
- To set the tunnel encryption strength
Answer: To prevent TCP fragmentation caused by GRE overhead reducing the effective MTU
GRE adds 24 bytes of overhead, reducing the effective MTU from 1500 to 1476. ip tcp adjust-mss 1436 modifies TCP SYN packets to negotiate a smaller MSS, preventing fragmentation.
NHRP in DMVPN maps tunnel IP addresses to _____ IP addresses dynamically.
Answer: physical
NHRP (Next Hop Resolution Protocol) resolves tunnel (overlay) IP addresses to physical (underlay) IP addresses. This allows spokes to find each other’s real IPs for direct tunnel establishment.
Cisco AnyConnect is an example of which VPN type?
- GRE tunnel
- DMVPN
- Full tunnel SSL/TLS VPN
- IPsec site-to-site VPN
Answer: Full tunnel SSL/TLS VPN
Cisco AnyConnect (now Cisco Secure Client) is a full-tunnel SSL VPN client. It routes all traffic through the VPN, providing the same experience as being on the corporate network.
Previous lesson: IPsec VPNs (remote access and site-to-site), AAA concepts (authentication, authorization, accounting), wireless security: WPA/WPA2/WPA3
Back to Cisco CCNA Preparation
Next lesson: Automation impact, controller-based networking, SDN architecture: overlay/underlay/fabric, northbound/southbound APIs, AI/ML in network ops