Assuming that you are using IKE preshared key authentication, and that a unique preshared key is used between each pair of gateways, how many unique preshared keys are required for an IPsec VPN consisting of 10 gateways? How many (end-entity) certificates are required if IKE RSA digital signature authentication is used instead?

45 unique preshared keys are required for an IPsec VPN consisting of 10 gateways. For the same number of gateways, 10 (end-entity) certificates are required.

What are two common ways to reduce the amount of configuration on gateways in an IPsec VPN?

TED and DMVPN. Wildcard preshared keys can also, to an extent, reduce the amount of configuration, although their use is not generally recommended.

What protocol does DMVPN rely on to provide direct spoke site-to-spoke site connectivity?

The Next Hop Resolution Protocol (NHRP).

What type of certificate is used for RSA digital signature authentication with IPsec?

The X.509 certificate is used.

What are two methods that a Cisco IOS router can use to check the revocation status of a certificate?

It can check the revocation status using a Certificate Revocation List (CRL) or it can use the Online Certificate Status Protocol (OCSP) to query an OCSP responder.

What are the three main ways to configure high availability in an (IOS) IPsec VPN?

The three main ways to configure high availability are to configure multiple IPsec peers (within a crypto) with IKE keepalives, use HSRP, or to use redundant GRE tunnels.

Why is fragmentation of IPsec packets undesirable?

It may cause IPsec packets to be dropped, and it will cause packet reassembly on a receiving IPsec gateway (which in turn causes high processor and memory overhead).

What ToS/DS value does an IPsec VPN gateway include in the outer header of an IPsec packet by default?

In transport mode, the ToS/DS value is preserved from the original user packet. In tunnel mode, the ToS/DS value is copied from the encapsulated user packet.

Why might packets associated with the same IPsec SA be dropped if they are subject to different QoS treatment in an intervening network between IPsec VPN gateways?

Packets might be dropped if QoS packet scheduling causes packet re-ordering, and this in turn causes some packets to fall outside (to the "left" of) the anti-replay window on the receiving IPsec VPN gateway.

What are some common ways to prevent fragmentation of IPsec packets?

Ensuring that end hosts send small user packets, fixing PMTUD, and using prefragmentation.