2V0-41.24 Question 392
Select 3You are tasked with connecting two datacenters using an IPSec VPN service in VMware NSX. While configuring the IPSec VPN service on NSX Manager, you encounter an issue where the VPN tunnel is not establishing. After reviewing the configuration, you realize that the issue is related to the Phase 1 parameters. Which of the following settings must be correctly configured for Phase 1 of the IPSec VPN to establish successfully?
- A
Matching encryption algorithm on both VPN endpoints
- B
Correct MTU size on the transport network
- C
Matching pre-shared key on both VPN endpoints
- D
Properly configured VPN route redistribution
- E
Matching Diffie-Hellman group on both VPN endpoints
Show answer and explanation
Correct answers: A, C, E
Explanation
Phase 1 of an IPSec VPN configuration involves setting up a secure channel for key exchange between the two endpoints. Critical parameters such as the encryption algorithm, pre-shared key, and Diffie-Hellman group must match on both sides to establish the Phase 1 tunnel successfully. MTU size and route redistribution, while important for other aspects of VPN operation, do not directly impact the Phase 1 establishment process.
- A. Correct.
Correct. The encryption algorithm must match on both VPN endpoints for Phase 1 to succeed. Mismatched encryption algorithms will result in the tunnel failing to establish.
- B. Incorrect.
Incorrect. While MTU size is important for optimal performance, it is not directly related to the Phase 1 failure of the IPSec VPN configuration.
- C. Correct.
Correct. A pre-shared key must match on both VPN endpoints. If there is a mismatch, the authentication will fail during Phase 1.
- D. Incorrect.
Incorrect. Route redistribution is related to routing traffic through the VPN but does not impact the establishment of Phase 1.
- E. Correct.
Correct. The Diffie-Hellman group must match on both VPN endpoints for secure key exchange during Phase 1. A mismatch will prevent the tunnel from being established.