300-410 IPsec Site-to-Site VPN — Timed 20 Questions

Question 1

A network engineer is troubleshooting an IPsec site-to-site VPN between two routers. The tunnel interface is up/up, but traffic from the local LAN to the remote LAN is not passing. The engineer checks the crypto map and sees it is applied to the outside interface. What is the most likely cause of the traffic failure?

Accepted Answer

The access list in the crypto map does not match the LAN-to-LAN traffic.. The tunnel interface being up/up indicates the GRE tunnel is operational, but traffic may still fail if the crypto map is not correctly triggering IPsec encryption for the actual data traffic. The most common cause is a missing or incorrect access list in the crypto map that defines interesting traffic.

Answer

The crypto map is not applied to the tunnel interface.

Answer

The IPsec transform set is missing the esp-aes encryption algorithm.

Answer

The IKE phase 1 proposal is mismatched between the two routers.

Question 2

A network engineer is troubleshooting an IPsec site-to-site VPN where the tunnel is not coming up. The engineer runs 'show crypto isakmp sa' and sees no active IKE SAs. The peer IP address is correctly configured. What should the engineer check first?

Accepted Answer

Check the IP connectivity between the two public IP addresses using ping.. The absence of IKE SAs indicates that IKE phase 1 negotiation has not started or failed. The first step is to verify that the routers can reach each other at the IP layer, as a connectivity issue will prevent any IKE exchange.

Answer

Verify that the crypto map is correctly applied to the outside interface.

Answer

Check the IPsec transform set configuration on both routers.

Answer

Verify the pre-shared key is identical on both routers.

Question 3

A network engineer is troubleshooting an IPsec site-to-site VPN between two Cisco routers. The tunnel is up, but traffic intermittently drops. The engineer notices that the 'show crypto ipsec sa' output shows the packet counters incrementing for both encrypt and decrypt, but the 'pkts encaps failed' counter is also increasing. What is the most likely cause?

Accepted Answer

The crypto map is not applied to the correct interface.. The 'pkts encaps failed' counter indicates that the router is unable to encrypt packets that should be encrypted. This typically happens when the crypto map's access list matches traffic, but the route to the remote LAN points out an interface that does not have the crypto map applied, causing the router to try to send the packet without encryption.

Answer

The IPsec transform set is misconfigured with incompatible algorithms.

Answer

The IKE keepalive timer is too short, causing frequent rekeying.

Answer

The MTU on the outside interface is too small, causing fragmentation.

Question 4

A network engineer is troubleshooting an IPsec site-to-site VPN where the tunnel is up but traffic from the remote LAN to the local LAN is not working. The engineer pings from the remote router to the local LAN IP and it succeeds. However, pings from a host on the remote LAN to a host on the local LAN fail. What is the most likely cause?

Accepted Answer

The local router does not have a route to the remote LAN subnet in its routing table.. The symptom indicates that the VPN tunnel is working for traffic sourced from the router itself, but not for traffic from the remote LAN. This is typically caused by a missing route on the local router for the remote LAN subnet, or a missing route on the remote router for the local LAN subnet, preventing the return traffic from being routed correctly.

Answer

The crypto map access list on the remote router does not include the remote LAN subnet.

Answer

The IPsec transform set is missing the esp-sha-hmac authentication.

Answer

The pre-shared key is mismatched between the two routers.

Question 5

A network engineer is troubleshooting an IPsec site-to-site VPN that uses a GRE tunnel over IPsec. The GRE tunnel is up/up, but the routing protocol (EIGRP) running over the GRE tunnel is not forming an adjacency. The engineer checks the tunnel configuration and sees that the tunnel source and destination are correct. What is the most likely cause?

Accepted Answer

The crypto map access list does not match GRE protocol (47) traffic.. For a GRE over IPsec tunnel, the GRE tunnel must be protected by the crypto map. If the crypto map is applied to the physical interface but the GRE tunnel traffic is not matched by the crypto map's access list, the GRE packets will be sent unencrypted and the remote router will drop them, preventing the routing protocol from forming an adjacency.

Answer

The EIGRP hello timer is set too high.

Answer

The tunnel interface is not configured with an IP address.

Answer

The IPsec transform set does not include ESP encryption.

Question 6

A network engineer is troubleshooting an IPsec site-to-site VPN where the tunnel is up, but the engineer notices that the 'show crypto ipsec sa' output shows that the number of packets encrypted is much higher than the number of packets decrypted on the remote side. What is the most likely cause?

Accepted Answer

The remote router has a misconfigured route that sends return traffic out the wrong interface.. A significant mismatch between encrypted and decrypted packet counts suggests that some packets are being lost or dropped after encryption. The most common cause is a routing issue where the return traffic from the remote side is not taking the VPN tunnel, so the remote router does not decrypt those packets.

Answer

The IPsec SA lifetime is set too low, causing frequent rekeying.

Answer

The crypto map on the local router is applied to the wrong interface.

Answer

The access list in the crypto map on the remote router is too permissive, encrypting extra traffic.

Question 7

A network engineer is troubleshooting an IPsec site-to-site VPN that stopped working after a recent configuration change. The engineer runs 'show crypto isakmp sa' and sees an active IKE SA, but 'show crypto ipsec sa' shows no IPsec SAs. What is the most likely cause?

Accepted Answer

The IPsec transform set on one router does not match the transform set on the other.. An active IKE SA indicates that IKE phase 1 completed successfully, but no IPsec SAs means phase 2 failed. The most common cause is a mismatch in the IPsec transform set or the crypto map access list between the two routers.

Answer

The pre-shared key is incorrect on one of the routers.

Answer

The tunnel interface is down.

Answer

The IKE proposal is mismatched.

Question 8

A network engineer is troubleshooting an IPsec site-to-site VPN where the tunnel is up and traffic is flowing, but the engineer notices that the 'show crypto ipsec sa' output shows the 'pkts encaps failed' counter incrementing slowly over time. The tunnel remains up. What is the most likely cause?

Accepted Answer

There is a floating static route that points to the physical interface instead of the tunnel for some subnets.. A slow but steady increase in 'pkts encaps failed' indicates that some packets that should be encrypted are not being encrypted. This is often caused by a routing issue where some traffic to the remote LAN is being routed out an interface that does not have the crypto map, bypassing encryption.

Answer

The crypto map is applied to the tunnel interface instead of the physical interface.

Answer

The IPsec SA lifetime is set too high.

Answer

The access list in the crypto map is too restrictive and missing some subnets.

Question 9

A network engineer is troubleshooting an IPsec site-to-site VPN that uses a GRE tunnel. The GRE tunnel is up/up, and EIGRP is forming an adjacency over it. However, traffic from the local LAN to the remote LAN is not working. The engineer pings the remote LAN IP from the local router and it succeeds. What is the most likely cause?

Accepted Answer

The local router does not have a route to the remote LAN subnet in its routing table.. The GRE tunnel and routing protocol are working, but traffic from the LAN is failing. This indicates that the routing table on the local router does not have a route to the remote LAN subnet, or the route points to the wrong next-hop. The ping from the router succeeds because the router uses its own IP as source, which is directly connected to the tunnel.

Answer

The crypto map access list does not include the local LAN subnet.

Answer

The GRE tunnel keepalive is disabled.

Answer

The IPsec transform set is missing authentication.

Question 10

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa
dst             src             state          conn-id slot status
10.1.1.2        10.1.1.1        MM_NO_STATE       1    0    ACTIVE

Based on this output, what is the problem?

Accepted Answer

The IKE phase 1 negotiation has failed; the pre-shared key may be mismatched.. The MM_NO_STATE indicates that the IKE phase 1 negotiation has not progressed past the initial state. This typically means the peer is not responding to the ISAKMP proposals, often due to mismatched pre-shared keys or access-list blocking UDP port 500.

Answer

The IPsec SA is established and working correctly.

Answer

The tunnel is up but no interesting traffic is triggering the IPsec SA.

Answer

The ISAKMP SA is in MM_ACTIVE state, meaning phase 1 is complete.

Question 11

A network engineer runs the following command on Router R1:

R1# show crypto ipsec sa
interface: Tunnel0
    Crypto map tag: VPN-MAP, local addr 10.1.1.1
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
   current_peer 10.1.1.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #send errors 0, #recv errors 0

Based on this output, what is the problem?

Accepted Answer

The tunnel is up but no traffic is being encrypted; the crypto ACL may not match the traffic.. The IPsec SA is present but the packet counters are all zero. This indicates that the tunnel is established but no interesting traffic is being sent through it. The likely cause is that the crypto ACL does not match the actual traffic or routing is not directing traffic into the tunnel.

Answer

The IPsec SA is not established; phase 1 is still pending.

Answer

The remote peer is unreachable; the SA is in a dead state.

Answer

The tunnel interface is down; the SA cannot be used.

Question 12

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa
dst             src             state          conn-id slot status
10.1.1.2        10.1.1.1        QM_IDLE           1    0    ACTIVE

Based on this output, which statement is correct?

Accepted Answer

IKE phase 1 is complete; the ISAKMP SA is established.. QM_IDLE indicates that IKE phase 1 (ISAKMP) is complete and the SA is idle, waiting for phase 2 negotiation. This is the normal state for an established ISAKMP SA.

Answer

IKE phase 2 is complete; the IPsec SA is active.

Answer

The ISAKMP SA is in MM_NO_STATE; negotiation has failed.

Answer

The tunnel is down; the SA is in a dead state.

Question 13

A network engineer runs the following command on Router R1:

R1# show crypto ipsec sa peer 10.1.1.2
interface: Tunnel0
    Crypto map tag: VPN-MAP, local addr 10.1.1.1
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
   current_peer 10.1.1.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 100, #pkts encrypt: 100, #pkts digest: 100
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #send errors 0, #recv errors 0

Based on this output, what is the problem?

Accepted Answer

The remote peer is not sending traffic back; check routing on the remote router.. The outbound packet count (encaps) is 100, but inbound (decaps) is 0. This suggests that traffic is being sent through the tunnel but no responses are being received, possibly due to a routing issue on the remote side or a firewall blocking return traffic.

Answer

The tunnel is working correctly; all packets are being encrypted and decrypted.

Answer

The local crypto ACL is misconfigured; it is not matching traffic.

Answer

The IPsec SA is not established; the tunnel is down.

Question 14

A network engineer runs the following command on Router R1:

R1# show crypto isakmp policy

Global IKE policy
Protection suite of priority 10
        encryption algorithm:   AES - Advanced Encryption Standard (256 bit keys).
        hash algorithm:         Secure Hash Standard 2 (SHA256)
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #14 (2048 bit)
        lifetime:               86400 seconds, no volume limit

Protection suite of priority 20
        encryption algorithm:   AES - Advanced Encryption Standard (128 bit keys).
        hash algorithm:         Secure Hash Standard 2 (SHA256)
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #14 (2048 bit)
        lifetime:               86400 seconds, no volume limit

Based on this output, which statement is correct?

Accepted Answer

The router has two IKE policies configured; policy 10 will be preferred.. The output shows the configured IKE policies. Both use pre-shared key authentication. This is a normal configuration for IPsec VPN.

Answer

The router has no IKE policies configured; the output is empty.

Answer

The router uses certificate-based authentication.

Answer

The Diffie-Hellman group is group 2 (1024 bit).

Question 15

A network engineer runs the following command on Router R1:

R1# show crypto ipsec transform-set
Transform set ESP-AES256-SHA: { esp-256-aes esp-sha256-hmac }
   will negotiate = { Tunnel,  },

Transform set ESP-AES128-SHA: { esp-aes esp-sha256-hmac }
   will negotiate = { Tunnel,  },

Based on this output, which statement is correct?

Accepted Answer

Both transform sets use tunnel mode; ESP-AES256-SHA uses stronger encryption.. The output shows two transform sets configured. The first uses AES-256 with SHA256 HMAC, the second uses AES-128 with SHA256 HMAC. Both use tunnel mode.

Answer

The transform sets use transport mode.

Answer

The transform sets use MD5 for hashing.

Answer

The transform sets are not compatible with IKEv2.

Question 16

A network engineer runs the following command on Router R1:

R1# show crypto map
Crypto Map "VPN-MAP" 10 ipsec-isakmp
    Peer = 10.1.1.2
    Extended IP access list 100
        access-list 100 permit ip 10.1.1.0 0.0.0.255 192.168.1.0 0.0.0.255
    Current peer: 10.1.1.2
    Security association lifetime: 4608000 kilobytes/3600 seconds
    PFS (Y/N): N
    Transform sets={ESP-AES256-SHA,}
    Interfaces using crypto map VPN-MAP:
        Tunnel0

Based on this output, which statement is correct?

Accepted Answer

The crypto map is applied to interface Tunnel0 and uses ACL 100 to define interesting traffic.. The crypto map is applied to Tunnel0 and uses ACL 100 to match traffic from 10.1.1.0/24 to 192.168.1.0/24. This is a typical site-to-site VPN configuration.

Answer

Perfect Forward Secrecy (PFS) is enabled.

Answer

The crypto map uses dynamic IPsec peer discovery.

Answer

The crypto map is not applied to any interface.

Question 17

A network engineer runs the following command on Router R1:

R1# show crypto ipsec sa | include pkts
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0

Based on this output, what is the problem?

Accepted Answer

No interesting traffic is being sent through the tunnel; check the crypto ACL and routing.. All packet counters are zero, indicating no traffic has been encrypted or decrypted. This could be due to a misconfigured crypto ACL that does not match the actual traffic, or routing issues preventing traffic from reaching the tunnel.

Answer

The IPsec SA is not established; the tunnel is down.

Answer

The tunnel is working correctly; all packets are being encrypted.

Answer

The remote peer is not responding; the SA is in MM_NO_STATE.

Question 18

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa detail
Codes: C - IKEv1, I - IKEv2

C-id  Local       Remote      I-VRF    Status Encr Hash Auth DH     Lifetime Cap
1     10.1.1.1    10.1.1.2              ACTIVE aes  sha  psk  14    23:59:59

Based on this output, which statement is correct?

Accepted Answer

The IKEv1 SA is established with the peer 10.1.1.2.. The ISAKMP SA is active, using AES encryption, SHA hash, pre-shared key authentication, and Diffie-Hellman group 14. The lifetime is about 24 hours.

Answer

The IKEv2 SA is established with the peer 10.1.1.2.

Answer

The ISAKMP SA is not established; status is MM_NO_STATE.

Answer

The Diffie-Hellman group is group 2.

Question 19

Given the following partial configuration on router R1:

crypto isakmp policy 10
 encryption aes 256
 authentication pre-share
 group 14
 lifetime 86400
!
crypto isakmp key cisco123 address 192.168.1.2
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
 mode tunnel
!
crypto map CMAP 10 ipsec-isakmp
 set peer 192.168.1.2
 set transform-set TSET
 match address 101
!
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 crypto map CMAP
!
access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

What is the effect of this configuration?

Accepted Answer

IPsec tunnel is established when traffic from 10.1.1.0/24 to 10.2.2.0/24 triggers it.. Option A is correct because the configuration uses a crypto map with 'match address 101' referencing an ACL that permits traffic from 10.1.1.0/24 to 10.2.2.0/24. This triggers IPsec SA negotiation via ISAKMP (IKEv1) only when interesting traffic is detected. The tunnel is established dynamically upon matching traffic, which is the standard behavior for a site-to-site VPN using a crypto map.

Answer

The tunnel will only be established if the peer initiates first.

Answer

The transform set uses AES 256 with MD5 authentication, which is incorrect.

Answer

ISAKMP lifetime is set to 86400 seconds, which is too short for a site-to-site VPN.

Question 20

Consider the following configuration on router R2:

crypto isakmp policy 10
 encryption aes 256
 authentication pre-share
 group 14
 lifetime 3600
!
crypto isakmp key secretkey address 192.168.1.1
!
crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac
 mode tunnel
!
crypto map CMAP 10 ipsec-isakmp
 set peer 192.168.1.1
 set transform-set TSET
 match address 101
!
interface GigabitEthernet0/1
 ip address 192.168.1.2 255.255.255.0
 crypto map CMAP
!
access-list 101 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255

Which statement is true?

Accepted Answer

The IKE phase 1 will fail due to ISAKMP lifetime mismatch.. The correct answer is B because the ISAKMP lifetime configured on R2 is 3600 seconds (1 hour), but the question implies the remote peer (192.168.1.1) has a different lifetime (likely the default of 86400 seconds). During IKE phase 1 negotiation, the peers propose their lifetimes, and if they do not match, the session fails because Cisco IOS requires identical lifetime values for successful phase 1 establishment. This mismatch causes the IKE phase 1 to fail, preventing the IPsec tunnel from forming.

Answer

The IPsec tunnel will establish successfully because the transform sets match.

Answer

The tunnel will work but will rekey every hour due to the shorter lifetime.

Answer

The pre-shared key mismatch will cause the tunnel to fail.