Explanation/Reference:
Section: Enterprise Network Design Explanation
Explanation:
IP Security (IPSec) provides confidentiality, integrity, and authentication. IPSec is a framework of protocols that can be used to provide security for virtual private network (VPN) connections. VPNs provide secure communications over an unsecure network, such as the Internet. IPSec provides data confidentiality by encrypting the data before it is sent over the connection. Because the data is encrypted, an attacker who intercepts the data will be unable to read it. IPSec provides data integrity by using checksums on each end of the connection. If the data generates the same checksum value on each end of the connection, the data was not modified in transit. IPSec also provides data authentication through various methods, including user name/password combinations, preshared keys, digital certificates, and onetime passwords (OTPs).
Generic Routing Encapsulation (GRE) is a protocol designed to tunnel any Layer 3 protocol through an IP transport network. Because the focus of GRE is to transport many different protocols, it has very limited security features. By contrast, IPSec has strong data confidentiality and data integrity features, but it can transport only IP traffic. GRE over IPSec combines the best features of both protocols to securely transport any protocol over an IP network. However, GRE itself does not provide confidentiality, integrity, and authentication.
Point-to-Point Protocol (PPP) is a WAN protocol that can be used on point-to-point serial links. PPP relies upon other protocols to provide authentication and security for the link. PPP itself does not provide confidentiality, integrity, and authentication.
PPP over Ethernet (PPPoE) is typically used to initiate a session with a Digital Subscriber Line (DSL) service provider. With PPPoE, PPP frames are encapsulated into Ethernet frames for transmission to the service provider. Because PPP frames are not encrypted, PPPoE cannot provide a secure connection.
PPPoE does not provide confidentiality, integrity, and authentication.
Reference:
CCDA 200-310 Official Cert Guide, Chapter 7, Enterprise Managed VPN: IPsec, pp. 255-259 Cisco: Configuring Security for VPNs with IPsec: IPsec Functionality Overview