2.2 Configure and verify data path virtualization technologies

What this section tests

Section 2.2 is a configure-and-verify topic. It is the hands-on core of Domain 2. The exam expects working configs and verification output, not only definitions.

You must be able to do these things:

• Put an interface into a Virtual Routing and Forwarding (VRF) instance and prove the table is separate.
• Use ping vrf, traceroute vrf, and show ip route vrf NAME to prove isolation.
• Build a GRE tunnel with a concrete source, destination, and tunnel IP address.
• Explain that GRE provides encapsulation, not encryption.
• Explain how IPsec protects GRE and which counters prove encryption works.
• Troubleshoot in the correct order: underlay reachability, tunnel endpoints, overlay routing, security associations, then MTU and MSS.

The two child objectives

• 2.2.a VRF: separate routing tables on one device. Configure, verify, and test isolation.
• 2.2.b GRE and IPsec Tunneling: a routable tunnel across an IP underlay, protected by IPsec.

Control points and proof

The mental model

VRF: BLUE traffic and RED traffic stay in separate tables on one router.
     VRF BLUE cannot route to VRF RED unless you leak routes on purpose.

GRE over IPsec: private packet -> route into Tunnel0 -> GRE encapsulation
     -> IPsec encryption -> underlay -> decrypt -> decapsulate -> deliver

The verification order matches the mental model. Prove the underlay first. Prove the tunnel second. Prove the protection third. Check MTU last.

Key commands

show ip vrf
show ip route vrf NAME
ping vrf NAME 10.10.10.2
show interfaces tunnel0
show run interface tunnel0
show crypto ikev2 sa
show crypto ipsec sa

Note: Older examples use show crypto isakmp sa for IKEv1. Newer IOS XE uses IKEv2. Recognize both.

Exam traps

• show ip route checks the global table, not a VRF table.
• GRE by itself is not encryption.
• The underlay must route between tunnel endpoints before anything else works.
• Overlay routes for remote private networks point to the tunnel IP, not the WAN IP.
• Tunnels add overhead. MTU problems can look like random application failures.

Pass check

You are ready for Section 2.2 when you can do these things:

• Configure two VRFs and prove their tables are separate.
• Bring up a GRE tunnel and show the expected show interfaces tunnel0 output.
• Explain the layer order of GRE over IPsec.
• Find the encaps and decaps counters in show crypto ipsec sa.
• Troubleshoot a tunnel failure in the correct order.