About this interactive
Students who meet five VPN acronyms in one module tend to remember them as five names for the same thing. They are not. Each was invented for a different shape of problem, and the fastest way to keep them apart is to ask two questions of any scenario: who or what sits at each end of the tunnel, and what has to cross it. That is what this matcher drills. Site-to-site IPsec is the case where both ends are networks, not people. A router at headquarters and a router at the branch build one tunnel and leave it up; every host behind either router uses it without knowing it exists, and no end user installs anything. IPsec tunnel mode is what makes that work, because it wraps the entire original packet - inner header and all - inside a new IP packet addressed router to router, so the two private subnets keep their own addressing across a public path. Remote access is the mirror image: one end is a network, the other is a single person. The tunnel is built by client software on one laptop, it exists only while that person is connected, and because the far endpoint is a human rather than a building, this is where multi-factor authentication belongs - the Cisco Duo push a remote worker approves is guarding this tunnel, not the site-to-site one. SSL/TLS VPN is remote access with the client requirement removed. When the machine on the far end belongs to a contractor, a customer, or a locked-down kiosk, you cannot install a VPN client on it, but every one of those machines already has a browser that speaks TLS. So the tunnel rides the same protocol that secures HTTPS, and the endpoint needs nothing new. Note the versioning detail the module flags: SSL is the deprecated ancestor and TLS is what actually runs, even though the industry still says "SSL VPN" out of habit. The comparison worth holding is IPsec versus TLS as the encryption method, and client-based versus clientless as the deployment consequence. DMVPN exists because site-to-site does not scale. Two sites need one tunnel. Forty sites that all need each other need hundreds, each configured by hand at both ends, and every new store reopens all of them. DMVPN replaces that full mesh with a hub-and-spoke registration: each spoke has one configured tunnel, to the hub, and when two spokes need to talk directly they build a tunnel between themselves on demand and tear it down afterward. The configuration is hub-and-spoke; the traffic path is close to a mesh. That gap between configured topology and actual topology is the whole idea, and it is a common exam target. GRE is the odd one out, and putting it in a VPN matcher is deliberate. A GRE tunnel is not a VPN, because it does not encrypt anything. It is pure encapsulation - a Cisco tunneling protocol that will carry protocols the underlying network refuses to route, which most often means an interior routing protocol’s multicast updates across a provider network that drops them. It is stateless and it keeps no secrets. That is why the real-world deployment is GRE over IPsec: GRE supplies transport for traffic IPsec alone cannot carry, and IPsec supplies the confidentiality GRE does not have. If a scenario asks for privacy and you answered GRE, the discriminator you missed was the word encrypted. Carry one habit out of this activity. When you meet a VPN question on the exam or a VPN requirement at work, do not start from the technology list - start from the ends of the tunnel. Network to network, always up, no user action: site-to-site. One user, on demand, with a client: remote access. One user, on demand, no client: SSL/TLS. Many sites, dynamic, hub-registered: DMVPN. A routing protocol or otherwise unroutable traffic, with no encryption asked for: GRE. The technology falls out of the scenario, which is the order the questions are written in.
About TechKnowSurge
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →