Ccse Ngx Ch. 5 - Site-To-Site Vpns

Front 1

In a Domain-based VPN, where can you configure VPN routing?

Back 1

Either directly through SmartDashboard or by editing the VPN routing-configuration files on the gateways.

Front 2

What must be done in the Rule base in order for VPN routing to succeed in a Domain-based VPN?

Back 2

A single rule must cover traffic in both directions, inbound and outbound, and on the central gateway. (148)

Front 3

A VTI is an _____________ level virtual interface that can be used as a Security Gateway to the VPN domain of the peer gateway.

Back 3

operating system (149)

Front 4

How many tunnels can each VTI be associated with?

Back 4

1

Front 5

Where are all of the VPN properties defined for a route based vpn?

Back 5

VPN community in SmartDashboard

Front 6

After setting up a VTI for a route based vpn, the peer gateway should be configured with a ___________ _______

Back 6

corresponding VTI

Front 7

Which type of VPN allows the use of dynamic routing?

Back 7

route based

Front 8

How far away does a peer gateway appear in a route based vpn?

Back 8

single hop

Front 9

What operating systems support route based vpn?

Back 9

SecurePlatform and IPSO 3.9 and higher

Front 10

In a route based vpn, where is the decision whether or not to encrypt a packet made?

Back 10

Routing to a virtual interface or not

Front 11

What operating system supports numbered VTI?

Back 11

SecurePlatform

Front 12

What operating system supports unnumbered VTI?

Back 12

IPSO 3.9+

Front 13

Can numbered VTIs share an IP address?

Back 13

Yes, but they cannot use an already existing physical-interface IP address

Front 14

What kind of interface must be assigned for unnumbered VTIs?

Back 14

proxy interface

Front 15

What must all gateways in a route based vpn multicast transfer have configured?

Back 15

VTI for each VPN tunnel and a multicast routing protocol must be enabled

Front 16

A VPN tunnel guarantees what three means of security?

Back 16

Authenticity - standard encryption methods
Privacy - encrypting data
Integrity - using standard integrity-assurance methods

Front 17

What is the purpose of a permanent tunnel?

Back 17

Keeps VPN tunnels active, allowing real-time monitoring capabilities.

Front 18

What is the purpose of VPN tunnel sharing?

Back 18

This feature provides greater interoperability and scalability between gateways. It also controls the number of VPN tunnels created between peer gateways.

Front 19

How is a permanent VPN tunnel monitored?

Back 19

By sending "tunnel test" packets. The tunnel is considered "up" if a response is received and "down" otherwise.

Front 20

What three options do you have for configuring the specificity of VPN tunnels?

Back 20

Specified for entire community
Specified for a specific gateway
Specified for a single VPN tunnel

Front 21

What technologies allow packets to fail over in non-clustered gateways in a permanent VPN tunnel?

Back 21

Multiple Entry Point environment where the Route Injection Mechanism is enabled.

Front 22

What are the four type fields in a tunnel test packet?

Back 22

test
reply
connect
connected

Front 23

For how long are connect messages retransmitted in VPN tunnel testing configuration?

Back 23

Up to 10 seconds after the IKE negotiation is over

Front 24

What is the purpose of vpn tunnel testing to use various lengths in test packets?

Back 24

To discover the Path Maximum Transmission Unit

Front 25

What are the three levels of scalability for VPN tunnels created in VPN tunnel sharing?

Back 25

1 tunnel per each pair of hosts
1 per subnet pair
1 per gateway pair

Front 26

In case of a conflict between the tunnel properties of a VPN community and a gateway object that is a member of the same community, which setting is followed?

Back 26

The "stricter" setting (e.g. 1 tunnel per pair of hosts would be selected above 1 tunnel per subnet pair)

Front 27

How does Wire Mode enable VPN connections to successfully fail over?

Back 27

By avoiding Stateful Inspection

Front 28

What questions does Wire Mode ask to determine if Stateful Inspection needs to be enforced?

Back 28

Is this information coming from a trusted source?
Is this information going to a trusted destination?

Front 29

On what platforms are Wire Mode supported?

Back 29

SecurePlatform and IPSO

Front 30

In directional VPN enforcement, clear text connections originating from what three sources are not subject to enforcement?

Back 30

Any Traffic
External_clear
Internal_clear

Front 31

In regards to physical restrictions, what is the difference between MEP and ClusterXL?

Back 31

MEP has no physical restriction
ClusterXL gateways need to be int he same location, directly connected via a sync interface

Front 32

In regards to management, what is the difference between MEP and ClusterXL?

Back 32

MEP gateways can be managed by different SmartCenter Servers

Front 33

What is the difference between MEP and ClusterXL in regards to state synchronization?

Back 33

MEP has no state synchronization

Front 34

How does the decision on which gateway to use differ in ClusterXL and MEP?

Back 34

In MEP, the decision is taken on the remote side. In ClusterXL, the decision is taken on the gateway side.

Front 35

To route traffic to a host behind a gateway what must be configured for that gateway?

Back 35

A VPN domain.

Front 36

What are the 2 ways configuration for VPN routing is performed?

Back 36

SmartDashboard or bey editing the VPN routing-configuration files on the Gateways.

Front 37

(T/F) VPN does not require access-control rules be entered in the rule base.

Back 37

False

Front 38

What must be covered in a rule, if a rule is necessary, for VPN routing to succeed.

Back 38

It must cover traffic in both directions, inbound and outbound, and on the central gateway.

Front 39

A ____ is an operating system virtual interface that can be used as a Security Gateway to the VPN domain of the peer gateway.

Back 39

VTI

Front 40

How many tunnels is each VTI associated with?

Back 40

One

Front 41

Route-based VPN is supported using what platforms?

Back 41

SPLAT and IPSO 3.9 and higher

Front 42

(T/F) Gateways do not need to be in the same Community for route-based VPNs.

Back 42

False

Front 43

Are VPN domains for each peer gateway necessary for route-based VPNs?

Back 43

No.

Front 44

How is the decision to encrypt handled in route-based VPN?

Back 44

traffic routed through the VTI is encrypted.

Front 45

What 2 ways can VTI be configured?

Back 45

Numbered and Unnumbered

Front 46

What is assigned to the interface if the VTI is numbered? (2)

Back 46

a local and remote IP address.

Front 47

(T/F) VTIs may share an IP address but cannot use an already existing physical-interface IP.

Back 47

True

Front 48

Numbered VTIs are only supported using which OS?

Back 48

SPLAT

Front 49

(T/F) IP addresses are configured for unnumbered VTIs.

Back 49

False

Front 50

Unnumbered VTIs must be assigned a _______ interface. This interface is used as the _________ for outbound traffic.

Back 50

Proxy
Source IP

Front 51

What is a benefit of unnumbered VTIs?

Back 51

It eliminates the need to allocate and manage and manage an IP per interface.

Front 52

Unnumbered VTIs are only supported on which OS?

Back 52

IPSO (3.9 and higher)

Front 53

What kind of IPSO interfaces may make use of unnumbered VTIs? (2)

Back 53

physical or loopback.

Front 54

(T/F) Multicast traffic can be encrypted and forwarded across VPN tunnels that were configured using VTIs.

Back 54

True

Front 55

What does a VPN tunnel guarantee? (3)

Back 55

1. Authenticity
2. Privacy
3. Integrity

Front 56

What feature keeps VPN tunnels active, allowing real-time monitoring capabilities?

Back 56

Permanent Tunnels

Front 57

What feature provides greater interoperability and scalability between gateways and controls the number of VPN tunnels created between peer gateways?

Back 57

VPN Tunnel Sharing

Front 58

(T/F) Permanent tunnels are constantly monitored and failure generates a log, alert, or other user defined action.

Back 58

True

Front 59

(T/F) Both peer gateways do not have to be Check Point firewalls to establish permanent tunnels.

Back 59

False

Front 60

Where does the configuration of permanent tunnels take place?

Back 60

the Community level.

Front 61

What are the 3 levels of granularity for specifying permanent tunnels?

Back 61

Community
Gateway
VPN tunnel

Front 62

What are the 4 types of tunnel testing packets?

Back 62

Type 1 Test
Type 2 Reply
Type 3 Connect
Type 4 Connected

Front 63

How many gateways are required for tunnel testing, and how is configuration accomplished?

Back 63

2. One is configured to ping and the other configured to respond.

Front 64

What port does a responder gateway listen to for tunnel testing?

Back 64

18234

Front 65

The pinging gateway sends _______ and ________ packets and the responder sends ________ and _______ packets, respectively.

Back 65

Type 1 Test
Type 3 Connect
Type 2 Reply
Type 4 Connected

Front 66

In what 2 ways is the tunnel tested during the connect phase.

Back 66

1) A connect message is sent to the gateway.
2) A series of test messages with various lengths is sent to discover the Path Maximum Transmission Unit of the connection.

Front 67

(T/F) In a MEP environment, gateways can either PING or Respond for tunnel testing.

Back 67

False. They may only respond.

Front 68

What is a Multiple Entry Point (MEP) environment?

Back 68

An environment in which active VPN tunnels are rerouted from the predefined primary gateway to the backup gateway if the primary becomes unavailable.

Front 69

What are the 3 settings available for VPN Tunnel Sharing?

Back 69

1)One VPN tunnel per each pair of hosts.
2) One VPN tunnel per subnet pair.
3) One VPN tunnel per Gateway pair.

Front 70

Where is the configuration set for VPN Tunnel Sharing for a Community?

Back 70

in the Tunnel Management dialog box of the Community Properties window.

Front 71

Where do you set the configuration for VPN Tunnel Sharing for a specific gateway?

Back 71

in the VPN Advanced dialog box of the gateway's properties window.

Front 72

(T/F) VPN Tunnel Sharing can be set on both the VPN Community and Gateway object.

Back 72

True

Front 73

What happens in the case of a conflict between the tunnel properties of a Community and a gateway object that is a member of that community?

Back 73

The most strict setting is followed.

Front 74

What was designed to improve connectivity by allowing existing connections to fail over successfully by bypassing firewall enforcement?

Back 74

Wire mode

Front 75

How is a gateway bypassed for VPN connection in wire mode?

Back 75

The internal interface of that gateway is defined as "trusted"

Front 76

What 2 questions are considered when a packet reaches a gateway in wire mode?

Back 76

1) Is it coming from a trusted source?
2) Is it going to a trusted destination?

Front 77

At what level is Wire Mode Enabled?

Back 77

The Community

Front 78

Wire mode is supported for _______ and higher gateways.

Back 78

NGX (R60) and higher

Front 79

Wire mode is only supported on _________ and ________ platforms.

Back 79

SPLAT
IPSO

Front 80

What is used if an administrator does not want VPN traffic to be bi-directional?

Back 80

directional VPN

Front 81

What is specified with directional VPN?

Back 81

Where the source IP must be and where the destination IP must be.

Front 82

Directional VPN enforcement can can take place in what two ways?

Back 82

Within a single VPN community
Between VPN communities

Front 83

in directional VPN enforcement, Cleartext connections originating from which 3 objects are not subject to enforcement.

Back 83

Any Traffic
External_clear
Internal_clear

Front 84

How many VPN directions can be configured in a single rule?

Back 84

there is no limit.

Front 85

What is recommended if you have many directional enforcements?

Back 85

a bi-directional rule.

Front 86

How do you enable directional enforcement?

Back 86

Global Properties > VPN > Advanced > check box Enable VPN Directional Match in VPN Column

Front 87

Is there a physical restriction on the location of MEP gateways?

Back 87

No. They can be geographically separated.

Front 88

(T/F) MEP Gateways can be managed by different SCSs.

Back 88

True

Front 89

(T/F) State is syncronized between MEP gateways.

Back 89

False

Front 90

In a MEP environment, the decision about which gateway to use is made on the ________ side. In a cluster it is on the _________ side.

Back 90

remote
gateway