AdvancedPublished 2026-11-02
CCNP DMVPN: Encrypt the Overlay
Today's daily lab
Included with a subscription.
Subscribe to unlockThe DMVPN carries every site in clear text, and branch 2 dropped off when it switched on encryption. Finish the IPsec rollout on the hub and branch 1.
Learning objectives
- Use one wildcard pre-shared key for dynamic peers
- Build a transport-mode profile for the multipoint tunnel
- Protect the hub and spoke tunnels and confirm direct spoke tunnels are encrypted
Troubleshooting focus
- A spoke stays down after the change: one end of its tunnel is protected and the other is not
- IKE never starts: the wildcard key is missing on one router
Topology
Subscribe to see the full topology.
See plansGrade your work
How this lab is graded
- Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with
access-class, are stated in the guide and do have to match. - Addresses, modes and protocol keywords are exact. An IP address, a subnet mask,
switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide. - Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the
running-config— a change that only exists in a terminal session never reaches the grader. - You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
- Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.
Found a problem with this lab?
Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.