300-410 Question 187
Select 2You are configuring a site-to-site IPsec VPN between two branch offices. During testing, you notice that traffic is not being encrypted. Upon checking the configuration, you find the following issues:
- The pre-shared keys on both ends do not match.
- The transform sets have mismatched encryption algorithms.
- The tunnel mode is not explicitly configured.
Which of these issues must be fixed to ensure the IPsec VPN functions correctly?
- A
The pre-shared keys on both ends must match.
- B
The transform sets must use matching encryption algorithms.
- C
The tunnel mode must be explicitly configured.
- D
Both ends must use the same routing protocol.
Show answer and explanation
Correct answers: A, B
Explanation
For an IPsec VPN to function, both the IKE Phase 1 (key exchange) and Phase 2 (tunnel establishment) processes must succeed. Matching pre-shared keys are required for authentication during Phase 1, and consistent transform sets are critical for ensuring both ends of the tunnel use compatible encryption and integrity algorithms in Phase 2. Tunnel mode configuration and routing protocols, while important in certain contexts, are not mandatory requirements for establishing basic IPsec functionality.
- A. Correct.
Pre-shared keys are essential for Phase 1 of the IPsec negotiation process. If the keys do not match, the IKE negotiation will fail, preventing the establishment of the IPsec tunnel.
- B. Correct.
Transform sets define the encryption and integrity algorithms for the IPsec tunnel. If these settings do not match on both ends, the tunnel cannot be established.
- C. Incorrect.
While tunnel mode is commonly used for site-to-site VPNs, it is the default mode in most configurations. Explicitly configuring it is not mandatory for the tunnel to function.
- D. Incorrect.
The use of the same routing protocol on both ends is not a requirement for IPsec VPNs. Routing protocols operate independently of the VPN tunnel and do not impact the IPsec negotiation process.