CCNP VPN Technologies — 10 Questions

Question 1

A network engineer is configuring a site-to-site IPsec VPN between two Cisco routers. The engineer wants to ensure that the VPN tunnel uses the strongest possible encryption and authentication algorithms. The engineer configures the following: crypto isakmp policy 10, authentication pre-share, encryption aes-256, group 14, lifetime 86400. On the remote router, the engineer configures: crypto isakmp policy 10, authentication pre-share, encryption aes-256, group 14, lifetime 86400. The tunnel fails to establish. What is the most likely cause?

Accepted Answer

The hash algorithm is not specified and defaults may differ between routers.. The IKE policy parameters must match exactly on both peers. In this scenario, the policies appear identical, but a common oversight is that the hash algorithm (e.g., SHA-256) is not specified in the policy; the default is MD5 or SHA-1 depending on IOS version. If one router uses default SHA-1 and the other uses MD5, the mismatch will prevent Phase 1 from completing. Option B is correct because the hash algorithm mismatch is a frequent cause of failure. Option A is incorrect because the lifetimes match. Option C is incorrect because group 14 is valid. Option D is incorrect because pre-shared keys can be used with strong encryption.

Answer

The lifetimes are set too high; they should be 3600 seconds.

Answer

The Diffie-Hellman group 14 is not supported on these routers.

Answer

Pre-shared keys cannot be used with AES-256 encryption.

Question 2

A network engineer is tasked with deploying a DMVPN Phase 2 network for a company with multiple branch offices. The hub router is a Cisco 4451-X and the spoke routers are Cisco 4331s. After configuration, the spokes can ping the hub's tunnel IP, but cannot reach each other's tunnel IPs. The engineer checks the routing tables and sees that the hub has routes for both spoke subnets, but the spokes do not have routes to each other. What is the most likely cause?

Accepted Answer

The hub is not configured to propagate spoke routes to other spokes.. In DMVPN Phase 2, spokes learn about other spoke networks via the hub using dynamic routing (e.g., EIGRP or OSPF). The hub must be configured to propagate spoke routes to other spokes. If the hub is not configured to redistribute or advertise the spoke subnets, the spokes will not have routes to each other. Option C is correct because the hub must have a routing configuration that allows spoke-to-spoke route propagation. Option A is incorrect because NHRP is used for mapping, not routing. Option B is incorrect because spoke-to-spoke tunnels are established dynamically via NHRP. Option D is incorrect because mGRE is the correct interface type for DMVPN.

Answer

The NHRP network ID is mismatched between the hub and spokes.

Answer

The spokes are not configured with a crypto map for IPsec.

Answer

The tunnel mode is set to GRE instead of mGRE on the spokes.

Question 3

An engineer is configuring a FlexVPN hub-and-spoke network. The hub router has a loopback0 with IP 10.0.0.1/32. The spokes are configured to use IKEv2 with certificates. The engineer notices that the spokes can establish the IKEv2 tunnel and can ping the hub's tunnel IP, but cannot reach the loopback0 address. The hub has a static route for the spoke subnets. What is the most likely issue?

Accepted Answer

The loopback0 is not advertised in the routing protocol.. In FlexVPN, the tunnel IP addresses are typically used for routing, and the loopback may not be advertised into the routing protocol or may not be reachable via the tunnel interface. If the hub's loopback is not included in the routing updates (e.g., via a network statement in EIGRP or OSPF), the spokes will not have a route to it. Option D is correct because the loopback is not being advertised. Option A is incorrect because IKEv2 is working. Option B is incorrect because certificates are not the issue. Option C is incorrect because the tunnel itself is up.

Answer

The IKEv2 proposal does not match between hub and spoke.

Answer

The certificate authority is not trusted by the hub.

Answer

The tunnel interface is not in an up/up state.

Question 4

A network engineer is configuring a GETVPN solution for a large enterprise with many remote sites. The engineer wants to ensure that all traffic between sites is encrypted using a common group key. The key server (KS) is a Cisco ASR 1000. After configuration, the group members (GMs) can register with the KS, but traffic between GMs is not encrypted. The engineer checks the KS configuration and sees that the crypto gdoi group has been defined with a transform set and a security association. What is the most likely missing configuration?

Accepted Answer

The KS is missing an access list to define the traffic to encrypt.. In GETVPN, the KS must define a traffic selector (access list) that specifies which traffic to encrypt. Without a proper access list, the KS will not send the policy to the GMs, and traffic will pass in the clear. Option A is correct because the access list is missing. Option B is incorrect because the group name is not the issue. Option C is incorrect because the KS does not need an IPsec profile. Option D is incorrect because GMs can be in different subnets.

Answer

The group name on the GMs does not match the KS.

Answer

The KS is not configured with an IPsec profile.

Answer

The GMs are in different IP subnets than the KS.

Question 5

An engineer is troubleshooting a site-to-site VPN between a Cisco ASA and a Cisco IOS router. The VPN is configured using IKEv1 with pre-shared keys. The tunnel establishes and traffic flows, but after a few hours, the tunnel drops and re-establishes. The engineer checks the logs and sees that the Phase 1 SA is being rekeyed. What is the most likely reason for the tunnel dropping?

Accepted Answer

The IKE Phase 1 lifetime is set too low.. IKE Phase 1 SAs have a lifetime; when the lifetime expires, the SA is rekeyed. If the rekey fails or is delayed, the tunnel may drop temporarily. Option B is correct because the lifetime expiration is the most common cause. Option A is incorrect because DPD is used to detect dead peers, not cause drops. Option C is incorrect because rekeying is normal. Option D is incorrect because the Phase 2 lifetime is separate.

Answer

The Dead Peer Detection (DPD) interval is too short.

Answer

The IPsec transform set is misconfigured.

Answer

The Phase 2 lifetime is longer than Phase 1.

Question 6

A network engineer is configuring a remote access VPN using Cisco AnyConnect on an ASA. The engineer wants to use certificate-based authentication. The ASA is configured with a CA server. After configuration, users can connect, but they are prompted for a username and password instead of using certificates. The engineer checks the ASA configuration and sees that the tunnel group has authentication method set to AAA. What should the engineer do to fix this?

Accepted Answer

Change the tunnel group authentication method to certificate.. For certificate-based authentication, the tunnel group must be configured to use certificate authentication. If it is set to AAA, the ASA will prompt for credentials. Option D is correct because the authentication method must be changed. Option A is incorrect because the CA is already configured. Option B is incorrect because the connection profile is not the issue. Option C is incorrect because the group policy does not control authentication method.

Answer

Re-enroll the CA certificate on the ASA.

Answer

Change the connection profile to use the correct group.

Answer

Configure the group policy to require certificates.

Question 7

An engineer is configuring a site-to-site VPN between two Cisco routers using IPsec with IKEv2. The engineer wants to use a pre-shared key. The configuration on both routers includes: crypto ikev2 proposal default, encryption aes-cbc-256, integrity sha256, group 14. The engineer also configures crypto ikev2 keyring and crypto ikev2 profile. The tunnel does not establish. The engineer sees that the IKEv2 SA is not created. What is the most likely missing configuration?

Accepted Answer

The IKEv2 profile is not attached to the crypto map or interface.. In IKEv2, the crypto ikev2 profile must be applied to the interface or the crypto map. Without applying the profile, the router will not use the configured keyring and proposal. Option B is correct because the profile must be attached. Option A is incorrect because the proposal is configured. Option C is incorrect because the transform set is for IPsec, not IKE. Option D is incorrect because the keyring is configured.

Answer

The IKEv2 proposal is not configured correctly.

Answer

The IPsec transform set is missing.

Answer

The pre-shared key is not defined in the keyring.

Question 8

A network engineer is configuring a DMVPN Phase 3 network. The hub router is a Cisco 4500X and the spokes are Cisco 4321s. The engineer wants to enable spoke-to-spoke direct communication. After configuration, the spokes can communicate via the hub, but not directly. The engineer checks the NHRP cache on a spoke and sees that it has a mapping for the other spoke's tunnel IP to the hub's physical IP. What is the most likely cause?

Accepted Answer

The hub is not configured with NHRP redirect.. In DMVPN Phase 3, spokes must use NHRP redirect and shortcut routes to enable direct spoke-to-spoke communication. If the hub is not configured with the NHRP redirect feature, the spokes will not receive the redirect messages, and traffic will continue to go through the hub. Option C is correct because the hub must have NHRP redirect enabled. Option A is incorrect because the spokes are registered. Option B is incorrect because the routing protocol is working. Option D is incorrect because the tunnel mode is correct.

Answer

The NHRP network ID is mismatched between the spokes.

Answer

The routing protocol is not redistributing spoke routes.

Answer

The spokes are using GRE instead of mGRE.

Question 9

An engineer is configuring a site-to-site VPN between two Cisco routers using IPsec with IKEv1. The engineer configures a crypto map on the outside interface. The tunnel establishes, but only traffic from one direction is encrypted. For example, traffic from Router A to Router B is encrypted, but traffic from Router B to Router A is not. The engineer checks the crypto map on Router B and finds that it is not applied to the correct interface. What is the most likely issue?

Accepted Answer

The crypto map is not applied to the outside interface on Router B.. For IPsec to work bidirectionally, the crypto map must be applied to the outside interface on both routers. If it is missing on one side, that router will not encrypt outgoing traffic. Option A is correct because the crypto map is not applied on Router B. Option B is incorrect because the access list is not the issue. Option C is incorrect because the transform set is used for encryption. Option D is incorrect because the peer is configured.

Answer

The access list on Router B is missing the permit statement for the traffic.

Answer

The transform set on Router B is different from Router A.

Answer

The peer address on Router B is configured incorrectly.

Question 10

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa
dst             src             state          conn-id slot
10.1.1.2        10.1.1.1        MM_NO_STATE       1       0

Based on this output, what can be concluded?

Accepted Answer

IKE Phase 1 is in progress but not yet complete.. The MM_NO_STATE indicates that the IKE Phase 1 negotiation has not progressed past the initial state. This typically means that the remote peer is not responding or the ISAKMP policy does not match.

Answer

The IPsec VPN tunnel is fully established and passing traffic.

Answer

The ISAKMP SA has been deleted due to a timeout.

Answer

The remote peer has rejected the IKE proposal.