300-410 VPN Technologies Practice Question
A network engineer is troubleshooting an IPsec VPN between two Cisco IOS routers. The tunnel is up, but traffic is not passing. The engineer runs `show crypto ipsec sa` and notices that the encaps/decaps counters are incrementing, but the inbound and outbound packets are being dropped. The ACL used for the VPN is `permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255`. What is the most likely cause of the dropped packets?
⚠ Common exam trap
The trap here is focusing on the ACL or transform set when the counters indicate encryption/decryption is working, overlooking post-decryption routing or RPF issues.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
There is a routing issue or reverse path forwarding (RPF) check failure for the decapsulated packets.
When IPsec encaps/decaps counters increment but packets are dropped, the router is encrypting and decrypting successfully. The drop likely occurs after decryption due to a routing or RPF check failure. The decrypted packet's source address must be reachable via the interface it arrived on; if not, Unicast RPF drops it. This is a common troubleshooting scenario in IPsec VPNs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
There is a routing issue or reverse path forwarding (RPF) check failure for the decapsulated packets.
Why this is correct
When encaps/decaps counters increment but packets are dropped, the router is successfully decrypting the packets. However, if there is no route back to the source or if Unicast RPF fails, the router drops the packets. This is a common issue where the decrypted packet's source is not reachable via the same interface it arrived on, triggering RPF drop.
- ✗
The IPsec SA is using the wrong transform set.
Why it's wrong here
If the transform set were mismatched, the IPsec SA would not be established, and the tunnel would not come up. Since the tunnel is up and encaps/decaps counters are incrementing, the transform set is compatible. The drops occur after decapsulation, indicating a different problem.
- ✗
The crypto map is applied to the wrong interface.
Why it's wrong here
If the crypto map were applied to the wrong interface, the tunnel would not establish, or traffic would not be encrypted. Since encaps/decaps counters are incrementing, the crypto map is correctly applied and processing traffic. The drop occurs after decryption, so the crypto map application is not the issue.
- ✗
The ACL is too restrictive and does not match the actual traffic.
Why it's wrong here
The ACL shown permits traffic from 10.1.1.0/24 to 10.2.2.0/24. If the actual traffic matches this, the ACL is correct. The issue of dropped packets despite encaps/decaps counters incrementing suggests the packets are being encrypted and decrypted but then discarded, possibly due to a routing or policy issue, not the ACL itself.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.