300-420 Question 206
Single answerAn enterprise network utilizes Group Encrypted Transport VPN (GET VPN) to secure data traffic across its WAN. However, the network administrator notices that some routers are not receiving the new Security Association (SA) keys after a rekey operation. What is the most likely cause of this issue?
- A
The Key Server (KS) is not reachable by the routers experiencing the issue.
- B
The routers experiencing the issue are not configured as GET VPN Group Members (GMs).
- C
The rekey messages are being blocked by a firewall between the Key Server (KS) and the Group Members (GMs).
- D
The Group Domain of Interpretation (GDOI) protocol is not supported on the affected routers.
Show answer and explanation
Correct answer: C
Explanation
In GET VPN, the Key Server (KS) distributes Security Association (SA) keys to all Group Members (GMs). If a firewall blocks the rekey messages from the KS, the affected routers cannot receive the updated keys, causing encryption and decryption issues. Ensuring that rekey messages can pass through all network devices is critical for successful GET VPN operation.
- A. Incorrect.
If the Key Server is not reachable, all Group Members (GMs) would fail to receive the rekey messages, not just specific routers. In this scenario, only some routers are affected.
- B. Incorrect.
Group Members (GMs) must be configured to participate in the GET VPN group. However, if they were not configured as GMs, they would not receive any initial keys at all, not just fail during a rekey operation.
- C. Correct.
If rekey messages are blocked by a firewall, affected routers will not receive new Security Association (SA) keys, which matches the described issue in the scenario.
- D. Incorrect.
GET VPN requires GDOI support on routers, but this issue would prevent the routers from participating in the group entirely, not just during rekey operations.