2V0-41.24 Question 197
Select 4An organization is planning to configure an IPSec VPN between their on-premises data center and an NSX-T Data Center environment. Which of the following are requirements for successfully establishing the IPSec VPN in NSX?
- A
Both endpoints must support IKEv2 or IKEv1 for negotiation.
- B
The NSX Edge must have a public IP address or be NATed to a public IP address.
- C
The IPSec VPN configuration must include a shared secret or certificate for authentication.
- D
The MTU size must always be set to 1500 bytes for compatibility.
- E
The local and remote subnets must not overlap.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To establish an IPSec VPN in NSX, key requirements include IKE protocol compatibility, public IP addressing for the NSX Edge, proper authentication mechanisms (such as shared secrets or certificates), and ensuring non-overlapping subnets for routing. MTU size configuration depends on the network's specific needs but is not a strict requirement for VPN establishment.
- A. Correct.
Correct: IPSec in NSX supports both IKEv1 and IKEv2 protocols, and both endpoints must support the same version for negotiation to succeed.
- B. Correct.
Correct: The NSX Edge must have a public IP address or be NATed to a public IP address to allow the VPN traffic to reach the other endpoint over the internet.
- C. Correct.
Correct: Shared secrets or certificates are mandatory for authentication in IPSec VPN configurations in NSX.
- D. Incorrect.
Incorrect: While MTU size impacts performance, it does not have to be set to 1500 bytes specifically. It can be configured based on network requirements and fragmentation considerations.
- E. Correct.
Correct: Overlapping subnets between local and remote networks can cause routing conflicts and prevent the VPN from functioning.