Exam 400-007 topic 1 question 54 discussion

Internet as underlay, GETVPN is not an option due to IP header preservation.

IPSEC & DMVPN, works in real life. GETVPN is for private (non Internet) WAN, at least in the Cisco world.

For those who say that we can combine DMVPN & GET VPN we would still be force to use IPsec. So, ... DMVPN + IPSec would do the trick that DMVPN & GET VPN offers.

DMVPN does work very nicely with GETVPN over Internet. My previous company always use DMVPN together with GETVPN. You have to realize that, GETVPN is just a better way to setup IPSEC SAs, in a group fashion instead of individually. For DMVPN with IPSEC, you need to configure IPSEC phase 1 and phase 2 configurations on all hubs and spokes, and the IPSEC SA will be created on the fly between hub/spoke or spoke/spoke when needed. For DMVPN with GETVPN, you configure IPSEC phase 1 and phase 2 configurations on the GDOI KS. All the hubs/spokes will get the same IPSEC SA from the GDOI KS, and do not need to create the SA on the fly. It is easier to manage and has better performance. The only risk is that you need to expose the GDOI KS to the Internet. Better protect it with a FW.

Tunnel Header Preservation I mentioned earlier that the IP header is preserved in GET VPN. In a traditional IPSec, the tunnel endpoint addresses are used as the new packet source and destination. The tunnel header preservation seems very similar to IPSec transport mode but the underlying mode of operation is IPSec tunnel mode. IPSec transport mode reuses the original IP header but it suffers from fragmentation and reassembly limitation and must not be used in deployments where encrypted or clear text packets may require fragmentation. GET VPN is suitable for MPLS, L2 or an IP infrastructure with end to end IP connectivity. It’s not suitable for deploying over the Internet though because the addresses are typically not routable and NAT functions interfere with the tunnel header preservation. GET VPN can be combined with DMVPN where DMVPN is used for routing and GET VPN for encryption.

Reading the question closely, private WAN strategy is GETVPN and the underlay for it would be DMVPN for transporting over the Internet https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_getvpn/configuration/xe-3s/sec-get-vpn-xe-3s-book/sec-get-vpn.html#:~:text=Cisco%20Group%20Encrypted%20Transport%20VPN%20%28GET%20VPN%29%20is,on%20or%20flows%20through%20a%20Cisco%20IOS%20device.

GETVPN alongwith DMVPN can be run over internet, see below: https://lostintransit.se/2016/02/12/ccde-introduction-to-get-vpn-and-get-vpn-design-considerations/?doing_wp_cron=1682702436.4848649501800537109375

GETVPN alongwith DMVPN can be run over internet, see below: https://lostintransit.se/2016/02/12/ccde-introduction-to-get-vpn-and-get-vpn-design-considerations/?doing_wp_cron=1682702436.4848649501800537109375

GETVPN does not support internet overlay due to IP header preservation https://ipwithease.com/getvpn-vs-dmvpn/