2.2 Configure and verify data path virtualization technologies

This checkpoint is published through the child objectives. Treat VRF and GRE/IPsec as hands-on configure-and-verify topics, not glossary terms.

For ENCOR, you should be able to:

• put an interface into a VRF and prove that the route table is separate;
• use ping vrf, traceroute vrf, and show ip route vrf NAME to verify path isolation;
• build or interpret a GRE tunnel, including tunnel source, tunnel destination, tunnel IP addressing, and the route that sends private traffic through the tunnel;
• explain that GRE provides encapsulation, not encryption;
• recognize how IPsec protects GRE traffic and which verification counters prove that packets are being encrypted and decrypted;
• troubleshoot failures in the correct order: underlay reachability, tunnel source and destination, overlay routing, IPsec security associations, then MTU and MSS.

Exam checklist

VRF BLUE cannot route to VRF RED unless leaked -> Private packet -> GRE → IPsec → underlay → decrypt → deliver -> Underlay ping · tunnel up · IKE/IPsec SA · MTU/MSS

show vrf
show ip route vrf NAME
ping vrf NAME <destination>
show interface tunnel0
show run interface tunnel0
show crypto ikev2 sa
show crypto isakmp sa # older IKEv1 examples
show crypto ipsec sa