300-410 Question 156
Select 3An enterprise network is implementing a site-to-site VPN solution between its headquarters and a remote branch office. The network engineer has decided to use IPsec VPNs. However, during testing, the engineer notices that the VPN tunnel intermittently fails to establish due to mismatched parameters. Which of the following configurations must match between the two endpoints to successfully establish the IPsec VPN tunnel?
- A
Encryption algorithm
- B
Pre-shared key
- C
Routing protocol used inside the VPN tunnel
- D
Diffie-Hellman group
- E
IP address of the local LAN interface
Show answer and explanation
Correct answers: A, B, D
Explanation
For an IPsec VPN tunnel to successfully establish, the security parameters such as the encryption algorithm, pre-shared key, and Diffie-Hellman group must match between the two endpoints. These parameters are essential for secure communication and proper negotiation of the IPsec Security Associations (SAs). Routing protocols and local LAN interface IP addresses are not part of the IPsec negotiation process and do not impact tunnel establishment.
- A. Correct.
The encryption algorithm must match on both sides because it ensures traffic is encrypted and decrypted consistently. A mismatch will cause the VPN tunnel to fail.
- B. Correct.
The pre-shared key must match between the two endpoints, as it is used to authenticate the peers during the establishment of the VPN tunnel. A mismatch will prevent the tunnel from initializing.
- C. Incorrect.
The routing protocol used inside the VPN tunnel does not need to match for the IPsec tunnel to establish, as it is unrelated to the tunnel's security parameters.
- D. Correct.
The Diffie-Hellman group must match on both endpoints because it determines the strength of the key exchange mechanism. A mismatch will cause the key exchange process to fail.
- E. Incorrect.
The IP address of the local LAN interface is not a factor in the establishment of the IPsec tunnel, as the tunnel is established between the public-facing interfaces of the VPN endpoints.