Google Professional Cloud Network Engineer Question 655
Select 3Google Cloud PlatformYou are configuring a site-to-site IPSec VPN between your on-premises data center and a Google Cloud Virtual Private Cloud (VPC). During the setup, the VPN tunnel is not establishing successfully. You suspect a configuration issue with the IPSec parameters. Which of the following configuration aspects should you verify to troubleshoot the issue?
- A
Ensure that the IKE version being used matches on both ends of the VPN tunnel.
- B
Confirm that the Cloud VPN gateway has been assigned a static external IP address.
- C
Verify that the firewall rules allow UDP traffic on ports 500 and 4500.
- D
Check if the MTU (Maximum Transmission Unit) value is set to 1400 bytes on both ends.
- E
Ensure that the pre-shared key (PSK) is identical on both the on-premises and Cloud VPN configurations.
Show answer and explanation
Correct answers: A, C, E
Explanation
To troubleshoot a site-to-site IPSec VPN setup, it is important to ensure that the IKE version, pre-shared key, and firewall rules are correctly configured. The IKE version must match on both ends for proper negotiation, the PSK must be identical for authentication, and the firewall must allow UDP traffic on the required ports for the VPN to function. While a static external IP and MTU settings are important, they are not directly related to the initial establishment of the IPSec VPN tunnel.
- A. Correct.
Ensuring that the IKE (Internet Key Exchange) version is consistent on both ends of the VPN tunnel is critical for successful negotiation and establishment of the VPN connection.
- B. Incorrect.
While a static external IP address is required for the Cloud VPN gateway, this is not directly related to troubleshooting the IPSec parameters for tunnel establishment.
- C. Correct.
Firewall rules allowing UDP traffic on ports 500 (IKE) and 4500 (NAT-T) are essential for IPSec VPN functionality. If these ports are blocked, the VPN tunnel cannot be established.
- D. Incorrect.
The MTU setting is important for optimizing data transfer across the VPN tunnel but is not directly related to the negotiation or establishment of the IPSec tunnel.
- E. Correct.
The pre-shared key (PSK) needs to match exactly on both the on-premises VPN device and the Cloud VPN configuration. Any mismatch will cause the VPN tunnel to fail during authentication.