350-401 Question 523
Select 3Your company is implementing a site-to-site IPsec VPN between two branch locations, and you are tasked with configuring the IPsec tunnel. During the initial configuration, you notice that the tunnel fails to establish. After investigating, you find that the problem is due to a mismatch in one of the IPsec Phase 1 parameters. Which of the following parameters must match between the two IPsec peers for the tunnel to establish?
- A
Encryption algorithm
- B
Hashing algorithm
- C
Pre-shared key
- D
IPsec transform set
- E
IKEv2 lifetime
Show answer and explanation
Correct answers: A, B, C
Explanation
In IPsec Phase 1, the parameters that must match between the two peers are the encryption algorithm, hashing algorithm, and pre-shared key. These settings ensure that both peers can properly authenticate and establish a secure channel for Phase 2 negotiations. Incorrect or mismatched configurations in these parameters will prevent the tunnel from being established. While the IPsec transform set and IKEv2 lifetime are important settings, they do not directly affect Phase 1 negotiations.
- A. Correct.
The encryption algorithm must match between the two peers to ensure secure communication during Phase 1 negotiations.
- B. Correct.
The hashing algorithm must match between the two peers because it is used for integrity verification during Phase 1 negotiations.
- C. Correct.
The pre-shared key is a critical authentication parameter in Phase 1 and must match between the two peers for the tunnel to establish.
- D. Incorrect.
The IPsec transform set is relevant to Phase 2, not Phase 1, so it does not need to match during Phase 1.
- E. Incorrect.
The IKEv2 lifetime is a configurable parameter but does not need to match between the peers for the tunnel to establish.