Explanation/Reference:
Section: Enterprise Network Design Explanation
Explanation/Reference:
IP Security (IPSec) Virtual Tunnel Interface (VTI), Generic Routing Encapsulation (GRE) over IPSec, and Dynamic Multipoint Virtual Private Network (DMVPN) hub-and-spoke virtual private network (VPN) tunnels support encapsulation of dynamic routing protocol traffic, such as Open Shortest Path First (OSPF) and Enhanced Interior Gateway Routing Protocol (EIGRP) traffic. A VPN tunnel provides secure, private network connectivity over an untrusted medium, such as the Internet.
IPSec VTI provides support for IP multicast and dynamic routing protocol traffic. However, it does not support non-IP protocols, and it has limited interoperability with non-Cisco routers.
GRE over IPSec provides support for IP multicast and dynamic routing protocol traffic. In addition, it provides support for non-IP protocols. Because the focus of GRE is to transport many different protocols, it has very limited security features. Therefore, GRE relies on IPSec to provide data confidentiality and data integrity. Although GRE was developed by Cisco, GRE works on Cisco and non-Cisco routers.
DMVPN hub-and-spoke VPN tunnels provide support for IP multicast and dynamic routing protocol traffic.
However, they support only IP traffic and operate only on Cisco routers.
DMVPN spoke-to-spoke VPN tunnels do not provide support for IP multicast or dynamic routing protocol traffic. In addition, they support only IP traffic and operate only on Cisco routers.
IPSec VPN tunnels do not provide support for IP multicast or dynamic routing protocol traffic. Although IPSec can be used on Cisco and non-Cisco routers, IPSec can be used only for IP traffic, it provides no support for non-IP protocols.
Reference:
CCDA 200-310 Official Cert Guide, Chapter 7, Enterprise VPN vs. Service Provider VPN, pp. 255-263 Cisco: IPSec VPN WAN Design Overview: Design Selection