300-410 Question 188
Select 3An organization has deployed site-to-site IPsec VPN between two branch offices using Cisco routers. During the deployment, the network engineer noticed that the VPN tunnel is not establishing. After reviewing the configuration, they suspect the issue is related to incorrect Phase 1 settings. Which of the following parameters must match on both sides for the VPN to establish successfully?
- A
Encryption algorithm
- B
Diffie-Hellman group
- C
IP address of the remote peer
- D
Pre-shared key
- E
Transform set
Show answer and explanation
Correct answers: A, B, D
Explanation
For a site-to-site IPsec VPN to establish, Phase 1 parameters such as the encryption algorithm, Diffie-Hellman group, and pre-shared key must match on both sides. These settings are critical for successfully negotiating and establishing the secure tunnel. The IP address of the remote peer and the transform set are either unrelated to Phase 1 or not required to match.
- A. Correct.
The encryption algorithm must match on both sides during IKE Phase 1 for the IPsec VPN to establish. This is required to ensure consistent encryption policies.
- B. Correct.
The Diffie-Hellman group defines the strength of the key exchange mechanism. Both peers must use the same group during Phase 1 to successfully establish the VPN tunnel.
- C. Incorrect.
The IP address of the remote peer does not have to match on both sides. It only needs to be correctly configured on each side to point to the opposite peer.
- D. Correct.
The pre-shared key must match on both sides for authentication during Phase 1. If the keys are mismatched, the VPN will fail to establish.
- E. Incorrect.
The transform set is used in Phase 2, not Phase 1. It determines the encryption and hashing settings for the data traffic, so it is not relevant to the current issue.