2V0-41.24 Question 186
Select 4An administrator is configuring an IPSec VPN between two NSX-T Data Center environments to enable secure communication between workloads in different locations. During testing, the VPN connection fails to establish. Upon reviewing the logs, the administrator observes that the error indicates a mismatch in encryption settings. Which configuration settings should the administrator verify to resolve the issue?
- A
Ensure that the IKE version is the same on both ends of the VPN tunnel.
- B
Verify that the same pre-shared key is configured on both sides of the tunnel.
- C
Confirm that the Diffie-Hellman group settings are identical on both VPN endpoints.
- D
Check that the IP addresses of the workloads match exactly on both sides of the VPN.
- E
Ensure that the encryption algorithm and hash algorithm settings are consistent on both VPN peers.
- F
Confirm that the MTU size is identical across the VPN endpoints.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
For an IPSec VPN to establish successfully, both endpoints must have matching configurations for critical parameters such as the IKE version, pre-shared key, Diffie-Hellman group, and encryption/hash algorithms. These settings ensure secure and compatible communication between the VPN peers. Mismatches in these configurations will lead to errors during the negotiation phase. Other factors, such as workload IP addresses and MTU size, do not directly impact the VPN establishment process.
- A. Correct.
The IKE version (e.g., IKEv1 or IKEv2) must match on both ends of the VPN tunnel for the negotiation process to succeed.
- B. Correct.
The pre-shared key is a critical security parameter, and a mismatch will prevent the VPN from establishing a connection.
- C. Correct.
The Diffie-Hellman group determines the strength of the key exchange, and both sides need to use the same group for secure negotiations.
- D. Incorrect.
Matching the IP addresses of the workloads is not relevant to the IPSec VPN configuration. The VPN tunnel operates at the network level and does not depend on workload IP address alignment.
- E. Correct.
The encryption and hash algorithms (e.g., AES, SHA) must match on both VPN peers, as mismatches in these settings will cause the negotiation to fail.
- F. Incorrect.
The MTU size is not directly related to the establishment of an IPSec VPN. While MTU issues can impact data transfer, they are not a cause for connection failure during negotiation.