300-410 IPsec Site-to-Site VPN Practice Test 1 — 15 Questions

Question 1

A network engineer is troubleshooting an IPsec site-to-site VPN between two routers. The tunnel interface is up/up, but traffic from the local LAN to the remote LAN is not passing. The engineer checks the crypto map and sees it is applied to the outside interface. What is the most likely cause of the traffic failure?

Accepted Answer

The access list in the crypto map does not match the LAN-to-LAN traffic.. The tunnel interface being up/up indicates the GRE tunnel is operational, but traffic may still fail if the crypto map is not correctly triggering IPsec encryption for the actual data traffic. The most common cause is a missing or incorrect access list in the crypto map that defines interesting traffic.

Answer

The crypto map is not applied to the tunnel interface.

Answer

The IPsec transform set is missing the esp-aes encryption algorithm.

Answer

The IKE phase 1 proposal is mismatched between the two routers.

Question 2

A network engineer is troubleshooting an IPsec site-to-site VPN where the tunnel is not coming up. The engineer runs 'show crypto isakmp sa' and sees no active IKE SAs. The peer IP address is correctly configured. What should the engineer check first?

Accepted Answer

Check the IP connectivity between the two public IP addresses using ping.. The absence of IKE SAs indicates that IKE phase 1 negotiation has not started or failed. The first step is to verify that the routers can reach each other at the IP layer, as a connectivity issue will prevent any IKE exchange.

Answer

Verify that the crypto map is correctly applied to the outside interface.

Answer

Check the IPsec transform set configuration on both routers.

Answer

Verify the pre-shared key is identical on both routers.

Question 3

A network engineer is troubleshooting an IPsec site-to-site VPN between two Cisco routers. The tunnel is up, but traffic intermittently drops. The engineer notices that the 'show crypto ipsec sa' output shows the packet counters incrementing for both encrypt and decrypt, but the 'pkts encaps failed' counter is also increasing. What is the most likely cause?

Accepted Answer

The crypto map is not applied to the correct interface.. The 'pkts encaps failed' counter indicates that the router is unable to encrypt packets that should be encrypted. This typically happens when the crypto map's access list matches traffic, but the route to the remote LAN points out an interface that does not have the crypto map applied, causing the router to try to send the packet without encryption.

Answer

The IPsec transform set is misconfigured with incompatible algorithms.

Answer

The IKE keepalive timer is too short, causing frequent rekeying.

Answer

The MTU on the outside interface is too small, causing fragmentation.

Question 4

A network engineer is troubleshooting an IPsec site-to-site VPN where the tunnel is up but traffic from the remote LAN to the local LAN is not working. The engineer pings from the remote router to the local LAN IP and it succeeds. However, pings from a host on the remote LAN to a host on the local LAN fail. What is the most likely cause?

Accepted Answer

The local router does not have a route to the remote LAN subnet in its routing table.. The symptom indicates that the VPN tunnel is working for traffic sourced from the router itself, but not for traffic from the remote LAN. This is typically caused by a missing route on the local router for the remote LAN subnet, or a missing route on the remote router for the local LAN subnet, preventing the return traffic from being routed correctly.

Answer

The crypto map access list on the remote router does not include the remote LAN subnet.

Answer

The IPsec transform set is missing the esp-sha-hmac authentication.

Answer

The pre-shared key is mismatched between the two routers.

Question 5

A network engineer is troubleshooting an IPsec site-to-site VPN that uses a GRE tunnel over IPsec. The GRE tunnel is up/up, but the routing protocol (EIGRP) running over the GRE tunnel is not forming an adjacency. The engineer checks the tunnel configuration and sees that the tunnel source and destination are correct. What is the most likely cause?

Accepted Answer

The crypto map access list does not match GRE protocol (47) traffic.. For a GRE over IPsec tunnel, the GRE tunnel must be protected by the crypto map. If the crypto map is applied to the physical interface but the GRE tunnel traffic is not matched by the crypto map's access list, the GRE packets will be sent unencrypted and the remote router will drop them, preventing the routing protocol from forming an adjacency.

Answer

The EIGRP hello timer is set too high.

Answer

The tunnel interface is not configured with an IP address.

Answer

The IPsec transform set does not include ESP encryption.

Question 6

A network engineer is troubleshooting an IPsec site-to-site VPN where the tunnel is up, but the engineer notices that the 'show crypto ipsec sa' output shows that the number of packets encrypted is much higher than the number of packets decrypted on the remote side. What is the most likely cause?

Accepted Answer

The remote router has a misconfigured route that sends return traffic out the wrong interface.. A significant mismatch between encrypted and decrypted packet counts suggests that some packets are being lost or dropped after encryption. The most common cause is a routing issue where the return traffic from the remote side is not taking the VPN tunnel, so the remote router does not decrypt those packets.

Answer

The IPsec SA lifetime is set too low, causing frequent rekeying.

Answer

The crypto map on the local router is applied to the wrong interface.

Answer

The access list in the crypto map on the remote router is too permissive, encrypting extra traffic.

Question 7

A network engineer is troubleshooting an IPsec site-to-site VPN that stopped working after a recent configuration change. The engineer runs 'show crypto isakmp sa' and sees an active IKE SA, but 'show crypto ipsec sa' shows no IPsec SAs. What is the most likely cause?

Accepted Answer

The IPsec transform set on one router does not match the transform set on the other.. An active IKE SA indicates that IKE phase 1 completed successfully, but no IPsec SAs means phase 2 failed. The most common cause is a mismatch in the IPsec transform set or the crypto map access list between the two routers.

Answer

The pre-shared key is incorrect on one of the routers.

Answer

The tunnel interface is down.

Answer

The IKE proposal is mismatched.

Question 8

A network engineer is troubleshooting an IPsec site-to-site VPN where the tunnel is up and traffic is flowing, but the engineer notices that the 'show crypto ipsec sa' output shows the 'pkts encaps failed' counter incrementing slowly over time. The tunnel remains up. What is the most likely cause?

Accepted Answer

There is a floating static route that points to the physical interface instead of the tunnel for some subnets.. A slow but steady increase in 'pkts encaps failed' indicates that some packets that should be encrypted are not being encrypted. This is often caused by a routing issue where some traffic to the remote LAN is being routed out an interface that does not have the crypto map, bypassing encryption.

Answer

The crypto map is applied to the tunnel interface instead of the physical interface.

Answer

The IPsec SA lifetime is set too high.

Answer

The access list in the crypto map is too restrictive and missing some subnets.

Question 9

A network engineer is troubleshooting an IPsec site-to-site VPN that uses a GRE tunnel. The GRE tunnel is up/up, and EIGRP is forming an adjacency over it. However, traffic from the local LAN to the remote LAN is not working. The engineer pings the remote LAN IP from the local router and it succeeds. What is the most likely cause?

Accepted Answer

The local router does not have a route to the remote LAN subnet in its routing table.. The GRE tunnel and routing protocol are working, but traffic from the LAN is failing. This indicates that the routing table on the local router does not have a route to the remote LAN subnet, or the route points to the wrong next-hop. The ping from the router succeeds because the router uses its own IP as source, which is directly connected to the tunnel.

Answer

The crypto map access list does not include the local LAN subnet.

Answer

The GRE tunnel keepalive is disabled.

Answer

The IPsec transform set is missing authentication.

Question 10

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa
dst             src             state          conn-id slot status
10.1.1.2        10.1.1.1        MM_NO_STATE       1    0    ACTIVE

Based on this output, what is the problem?

Accepted Answer

The IKE phase 1 negotiation has failed; the pre-shared key may be mismatched.. The MM_NO_STATE indicates that the IKE phase 1 negotiation has not progressed past the initial state. This typically means the peer is not responding to the ISAKMP proposals, often due to mismatched pre-shared keys or access-list blocking UDP port 500.

Answer

The IPsec SA is established and working correctly.

Answer

The tunnel is up but no interesting traffic is triggering the IPsec SA.

Answer

The ISAKMP SA is in MM_ACTIVE state, meaning phase 1 is complete.

Question 11

A network engineer runs the following command on Router R1:

R1# show crypto ipsec sa
interface: Tunnel0
    Crypto map tag: VPN-MAP, local addr 10.1.1.1
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
   current_peer 10.1.1.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #send errors 0, #recv errors 0

Based on this output, what is the problem?

Accepted Answer

The tunnel is up but no traffic is being encrypted; the crypto ACL may not match the traffic.. The IPsec SA is present but the packet counters are all zero. This indicates that the tunnel is established but no interesting traffic is being sent through it. The likely cause is that the crypto ACL does not match the actual traffic or routing is not directing traffic into the tunnel.

Answer

The IPsec SA is not established; phase 1 is still pending.

Answer

The remote peer is unreachable; the SA is in a dead state.

Answer

The tunnel interface is down; the SA cannot be used.

Question 12

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa
dst             src             state          conn-id slot status
10.1.1.2        10.1.1.1        QM_IDLE           1    0    ACTIVE

Based on this output, which statement is correct?

Accepted Answer

IKE phase 1 is complete; the ISAKMP SA is established.. QM_IDLE indicates that IKE phase 1 (ISAKMP) is complete and the SA is idle, waiting for phase 2 negotiation. This is the normal state for an established ISAKMP SA.

Answer

IKE phase 2 is complete; the IPsec SA is active.

Answer

The ISAKMP SA is in MM_NO_STATE; negotiation has failed.

Answer

The tunnel is down; the SA is in a dead state.

Question 13

A network engineer runs the following command on Router R1:

R1# show crypto ipsec sa peer 10.1.1.2
interface: Tunnel0
    Crypto map tag: VPN-MAP, local addr 10.1.1.1
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
   current_peer 10.1.1.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 100, #pkts encrypt: 100, #pkts digest: 100
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #send errors 0, #recv errors 0

Based on this output, what is the problem?

Accepted Answer

The remote peer is not sending traffic back; check routing on the remote router.. The outbound packet count (encaps) is 100, but inbound (decaps) is 0. This suggests that traffic is being sent through the tunnel but no responses are being received, possibly due to a routing issue on the remote side or a firewall blocking return traffic.

Answer

The tunnel is working correctly; all packets are being encrypted and decrypted.

Answer

The local crypto ACL is misconfigured; it is not matching traffic.

Answer

The IPsec SA is not established; the tunnel is down.

Question 14

A network engineer runs the following command on Router R1:

R1# show crypto isakmp policy

Global IKE policy
Protection suite of priority 10
        encryption algorithm:   AES - Advanced Encryption Standard (256 bit keys).
        hash algorithm:         Secure Hash Standard 2 (SHA256)
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #14 (2048 bit)
        lifetime:               86400 seconds, no volume limit

Protection suite of priority 20
        encryption algorithm:   AES - Advanced Encryption Standard (128 bit keys).
        hash algorithm:         Secure Hash Standard 2 (SHA256)
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #14 (2048 bit)
        lifetime:               86400 seconds, no volume limit

Based on this output, which statement is correct?

Accepted Answer

The router has two IKE policies configured; policy 10 will be preferred.. The output shows the configured IKE policies. Both use pre-shared key authentication. This is a normal configuration for IPsec VPN.

Answer

The router has no IKE policies configured; the output is empty.

Answer

The router uses certificate-based authentication.

Answer

The Diffie-Hellman group is group 2 (1024 bit).

Question 15

A network engineer runs the following command on Router R1:

R1# show crypto ipsec transform-set
Transform set ESP-AES256-SHA: { esp-256-aes esp-sha256-hmac }
   will negotiate = { Tunnel,  },

Transform set ESP-AES128-SHA: { esp-aes esp-sha256-hmac }
   will negotiate = { Tunnel,  },

Based on this output, which statement is correct?

Accepted Answer

Both transform sets use tunnel mode; ESP-AES256-SHA uses stronger encryption.. The output shows two transform sets configured. The first uses AES-256 with SHA256 HMAC, the second uses AES-128 with SHA256 HMAC. Both use tunnel mode.

Answer

The transform sets use transport mode.

Answer

The transform sets use MD5 for hashing.

Answer

The transform sets are not compatible with IKEv2.