IPsec Site-to-Site VPN practice questions

A network engineer is troubleshooting an IPsec site-to-site VPN between two routers. The tunnel interface is up/up, but traffic from the local LAN to the remote LAN is not passing. The engineer checks the crypto map and sees it is applied to the outside interface. What is the most likely cause of the traffic failure?

Trap 1: The crypto map is not applied to the tunnel interface.

Incorrect because the crypto map should be applied to the physical outside interface, not the tunnel interface.

Trap 2: The IPsec transform set is missing the esp-aes encryption algorithm.

Incorrect because the transform set configuration is for the encryption and authentication algorithms; a missing algorithm would cause phase 2 negotiation failure, but the tunnel is up.

Trap 3: The IKE phase 1 proposal is mismatched between the two routers.

Incorrect because if IKE phase 1 were mismatched, the tunnel would not come up at all.

A
The crypto map is not applied to the tunnel interface.
Why wrong: Incorrect because the crypto map should be applied to the physical outside interface, not the tunnel interface.
B
The access list in the crypto map does not match the LAN-to-LAN traffic.
Correct because the crypto map uses an access list to define which traffic is encrypted; if it does not match the actual LAN subnets, traffic will be sent unencrypted and may be dropped by the remote router.
C
The IPsec transform set is missing the esp-aes encryption algorithm.
Why wrong: Incorrect because the transform set configuration is for the encryption and authentication algorithms; a missing algorithm would cause phase 2 negotiation failure, but the tunnel is up.
D
The IKE phase 1 proposal is mismatched between the two routers.
Why wrong: Incorrect because if IKE phase 1 were mismatched, the tunnel would not come up at all.

Question 2mediummultiple choice

A network engineer is troubleshooting an IPsec site-to-site VPN where the tunnel is not coming up. The engineer runs 'show crypto isakmp sa' and sees no active IKE SAs. The peer IP address is correctly configured. What should the engineer check first?

Trap 1: Verify that the crypto map is correctly applied to the outside…

Incorrect because the crypto map application is important but if IKE SAs are not even appearing, the issue is more fundamental—connectivity.

Trap 2: Check the IPsec transform set configuration on both routers.

Incorrect because transform set is used in phase 2; phase 1 must complete first.

Trap 3: Verify the pre-shared key is identical on both routers.

Incorrect because a pre-shared key mismatch would cause IKE phase 1 to fail, but the engineer should first verify basic connectivity before checking authentication.

A
Verify that the crypto map is correctly applied to the outside interface.
Why wrong: Incorrect because the crypto map application is important but if IKE SAs are not even appearing, the issue is more fundamental—connectivity.
B
Check the IP connectivity between the two public IP addresses using ping.
Correct because without basic IP reachability, IKE packets cannot be exchanged, and the VPN cannot establish.
C
Check the IPsec transform set configuration on both routers.
Why wrong: Incorrect because transform set is used in phase 2; phase 1 must complete first.
D
Verify the pre-shared key is identical on both routers.
Why wrong: Incorrect because a pre-shared key mismatch would cause IKE phase 1 to fail, but the engineer should first verify basic connectivity before checking authentication.

Question 3hardmultiple choice

A network engineer is troubleshooting an IPsec site-to-site VPN between two Cisco routers. The tunnel is up, but traffic intermittently drops. The engineer notices that the 'show crypto ipsec sa' output shows the packet counters incrementing for both encrypt and decrypt, but the 'pkts encaps failed' counter is also increasing. What is the most likely cause?

Trap 1: The IPsec transform set is misconfigured with incompatible…

Incorrect because if the transform set were incompatible, the tunnel would not be up and SAs would not be established.

Trap 2: The IKE keepalive timer is too short, causing frequent rekeying.

Incorrect because keepalive timers affect session stability but do not cause encapsulation failures.

Trap 3: The MTU on the outside interface is too small, causing…

Incorrect because fragmentation issues would typically show as 'pkts fragmented' or 'pkts not fragmented' counters, not encapsulation failures.

A
The crypto map is not applied to the correct interface.
Correct because if the route to the remote LAN points to an interface without the crypto map, the router will attempt to send the packet unencrypted, resulting in encapsulation failure.
B
The IPsec transform set is misconfigured with incompatible algorithms.
Why wrong: Incorrect because if the transform set were incompatible, the tunnel would not be up and SAs would not be established.
C
The IKE keepalive timer is too short, causing frequent rekeying.
Why wrong: Incorrect because keepalive timers affect session stability but do not cause encapsulation failures.
D
The MTU on the outside interface is too small, causing fragmentation.
Why wrong: Incorrect because fragmentation issues would typically show as 'pkts fragmented' or 'pkts not fragmented' counters, not encapsulation failures.

Question 4hardmultiple choice

A network engineer is troubleshooting an IPsec site-to-site VPN where the tunnel is up but traffic from the remote LAN to the local LAN is not working. The engineer pings from the remote router to the local LAN IP and it succeeds. However, pings from a host on the remote LAN to a host on the local LAN fail. What is the most likely cause?

Trap 1: The crypto map access list on the remote router does not include…

Incorrect because the tunnel is up and traffic from the remote router works, so the access list is likely correct.

Trap 2: The IPsec transform set is missing the esp-sha-hmac authentication.

Incorrect because the tunnel is up and working for router-initiated traffic, so the transform set is fine.

Trap 3: The pre-shared key is mismatched between the two routers.

Incorrect because a pre-shared key mismatch would prevent the tunnel from coming up at all.

A
The crypto map access list on the remote router does not include the remote LAN subnet.
Why wrong: Incorrect because the tunnel is up and traffic from the remote router works, so the access list is likely correct.
B
The local router does not have a route to the remote LAN subnet in its routing table.
Correct because the local router must have a route to the remote LAN subnet to route the return traffic back through the tunnel. Without it, the return traffic is dropped.
C
The IPsec transform set is missing the esp-sha-hmac authentication.
Why wrong: Incorrect because the tunnel is up and working for router-initiated traffic, so the transform set is fine.
D
The pre-shared key is mismatched between the two routers.
Why wrong: Incorrect because a pre-shared key mismatch would prevent the tunnel from coming up at all.

Study the full EIGRP explanation →

Question 5mediummultiple choice

A network engineer is troubleshooting an IPsec site-to-site VPN that uses a GRE tunnel over IPsec. The GRE tunnel is up/up, but the routing protocol (EIGRP) running over the GRE tunnel is not forming an adjacency. The engineer checks the tunnel configuration and sees that the tunnel source and destination are correct. What is the most likely cause?

Trap 1: The EIGRP hello timer is set too high.

Incorrect because a high hello timer would cause slow convergence, not a complete failure to form adjacency.

Trap 2: The tunnel interface is not configured with an IP address.

Incorrect because the tunnel is up/up, so it must have an IP address.

Trap 3: The IPsec transform set does not include ESP encryption.

Incorrect because the transform set is used for IPsec, but the issue is that GRE packets are not being encrypted at all.

A
The crypto map access list does not match GRE protocol (47) traffic.
Correct because GRE uses protocol 47; if the crypto map's access list only matches IP traffic between the LAN subnets, the GRE packets themselves are not encrypted and are dropped, causing the GRE tunnel to appear up but the routing protocol to fail.
B
The EIGRP hello timer is set too high.
Why wrong: Incorrect because a high hello timer would cause slow convergence, not a complete failure to form adjacency.
C
The tunnel interface is not configured with an IP address.
Why wrong: Incorrect because the tunnel is up/up, so it must have an IP address.
D
The IPsec transform set does not include ESP encryption.
Why wrong: Incorrect because the transform set is used for IPsec, but the issue is that GRE packets are not being encrypted at all.

Question 6hardmultiple choice

A network engineer is troubleshooting an IPsec site-to-site VPN where the tunnel is up, but the engineer notices that the 'show crypto ipsec sa' output shows that the number of packets encrypted is much higher than the number of packets decrypted on the remote side. What is the most likely cause?

Trap 1: The IPsec SA lifetime is set too low, causing frequent rekeying.

Incorrect because frequent rekeying would cause brief interruptions but not a persistent mismatch in packet counts.

Trap 2: The crypto map on the local router is applied to the wrong…

Incorrect because if the crypto map were on the wrong interface, the tunnel would likely not be up.

Trap 3: The access list in the crypto map on the remote router is too…

Incorrect because that would cause the remote router to encrypt more packets, not fewer.

A
The remote router has a misconfigured route that sends return traffic out the wrong interface.
Correct because if the remote router does not have a route to the local LAN that points to the tunnel interface, the return traffic will be sent out the physical interface without encryption, and the local router will not see corresponding decrypted packets.
B
The IPsec SA lifetime is set too low, causing frequent rekeying.
Why wrong: Incorrect because frequent rekeying would cause brief interruptions but not a persistent mismatch in packet counts.
C
The crypto map on the local router is applied to the wrong interface.
Why wrong: Incorrect because if the crypto map were on the wrong interface, the tunnel would likely not be up.
D
The access list in the crypto map on the remote router is too permissive, encrypting extra traffic.
Why wrong: Incorrect because that would cause the remote router to encrypt more packets, not fewer.

Question 7mediummultiple choice

A network engineer is troubleshooting an IPsec site-to-site VPN that stopped working after a recent configuration change. The engineer runs 'show crypto isakmp sa' and sees an active IKE SA, but 'show crypto ipsec sa' shows no IPsec SAs. What is the most likely cause?

Trap 1: The pre-shared key is incorrect on one of the routers.

Incorrect because a pre-shared key mismatch would cause IKE phase 1 to fail, not phase 2.

Trap 2: The tunnel interface is down.

Incorrect because the issue is with IPsec SAs, not the tunnel interface.

Trap 3: The IKE proposal is mismatched.

Incorrect because an IKE proposal mismatch would cause phase 1 to fail, but phase 1 is active.

A
The IPsec transform set on one router does not match the transform set on the other.
Correct because during phase 2, the routers negotiate the transform set; if they do not match, the IPsec SA cannot be established.
B
The pre-shared key is incorrect on one of the routers.
Why wrong: Incorrect because a pre-shared key mismatch would cause IKE phase 1 to fail, not phase 2.
C
The tunnel interface is down.
Why wrong: Incorrect because the issue is with IPsec SAs, not the tunnel interface.
D
The IKE proposal is mismatched.
Why wrong: Incorrect because an IKE proposal mismatch would cause phase 1 to fail, but phase 1 is active.

Question 8hardmultiple choice

A network engineer is troubleshooting an IPsec site-to-site VPN where the tunnel is up and traffic is flowing, but the engineer notices that the 'show crypto ipsec sa' output shows the 'pkts encaps failed' counter incrementing slowly over time. The tunnel remains up. What is the most likely cause?

Trap 1: The crypto map is applied to the tunnel interface instead of the…

Incorrect because applying the crypto map to the tunnel interface would cause all tunnel traffic to fail, not just some packets.

Trap 2: The IPsec SA lifetime is set too high.

Incorrect because SA lifetime does not cause encapsulation failures.

Trap 3: The access list in the crypto map is too restrictive and missing…

Incorrect because if the access list were missing subnets, those packets would not be matched and would be sent unencrypted, but the 'pkts encaps failed' counter specifically counts packets that are matched but cannot be encrypted due to routing issues.

A
There is a floating static route that points to the physical interface instead of the tunnel for some subnets.
Correct because if a floating static route (with a higher administrative distance) becomes active for some traffic, those packets will be sent out the physical interface without encryption, causing encapsulation failures.
B
The crypto map is applied to the tunnel interface instead of the physical interface.
Why wrong: Incorrect because applying the crypto map to the tunnel interface would cause all tunnel traffic to fail, not just some packets.
C
The IPsec SA lifetime is set too high.
Why wrong: Incorrect because SA lifetime does not cause encapsulation failures.
D
The access list in the crypto map is too restrictive and missing some subnets.
Why wrong: Incorrect because if the access list were missing subnets, those packets would not be matched and would be sent unencrypted, but the 'pkts encaps failed' counter specifically counts packets that are matched but cannot be encrypted due to routing issues.

Study the full EIGRP explanation →

Question 9mediummultiple choice

A network engineer is troubleshooting an IPsec site-to-site VPN that uses a GRE tunnel. The GRE tunnel is up/up, and EIGRP is forming an adjacency over it. However, traffic from the local LAN to the remote LAN is not working. The engineer pings the remote LAN IP from the local router and it succeeds. What is the most likely cause?

Trap 1: The crypto map access list does not include the local LAN subnet.

Incorrect because the tunnel is up and EIGRP is working, so the access list is likely correct for the tunnel traffic.

Trap 2: The GRE tunnel keepalive is disabled.

Incorrect because keepalive only affects tunnel stability, not routing.

Trap 3: The IPsec transform set is missing authentication.

Incorrect because the tunnel is up and working for router-initiated traffic, so the transform set is fine.

A
The local router does not have a route to the remote LAN subnet in its routing table.
Correct because the router can ping the remote LAN using its own IP, but if there is no route for the remote LAN subnet, traffic from LAN hosts will be dropped.
B
The crypto map access list does not include the local LAN subnet.
Why wrong: Incorrect because the tunnel is up and EIGRP is working, so the access list is likely correct for the tunnel traffic.
C
The GRE tunnel keepalive is disabled.
Why wrong: Incorrect because keepalive only affects tunnel stability, not routing.
D
The IPsec transform set is missing authentication.
Why wrong: Incorrect because the tunnel is up and working for router-initiated traffic, so the transform set is fine.

Question 10mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa

dst src state conn-id slot status

10.1.1.2        10.1.1.1        MM_NO_STATE       1    0    ACTIVE

Based on this output, what is the problem?

Trap 1: The IPsec SA is established and working correctly.

MM_NO_STATE means no state has been established; IPsec SA would show QM_IDLE or other states.

Trap 2: The tunnel is up but no interesting traffic is triggering the IPsec…

No ISAKMP SA exists, so no IPsec SA can be formed regardless of traffic.

Trap 3: The ISAKMP SA is in MM_ACTIVE state, meaning phase 1 is complete.

The state shown is MM_NO_STATE, not MM_ACTIVE.

A
The IPsec SA is established and working correctly.
Why wrong: MM_NO_STATE means no state has been established; IPsec SA would show QM_IDLE or other states.
B
The IKE phase 1 negotiation has failed; the pre-shared key may be mismatched.
MM_NO_STATE indicates no ISAKMP SA has been formed, often due to pre-shared key mismatch or firewall blocking UDP 500.
C
The tunnel is up but no interesting traffic is triggering the IPsec SA.
Why wrong: No ISAKMP SA exists, so no IPsec SA can be formed regardless of traffic.
D
The ISAKMP SA is in MM_ACTIVE state, meaning phase 1 is complete.
Why wrong: The state shown is MM_NO_STATE, not MM_ACTIVE.

Question 11mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show crypto ipsec sa
interface: Tunnel0
    Crypto map tag: VPN-MAP, local addr 10.1.1.1

protected vrf: (none) local ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) current_peer 10.1.1.2 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #send errors 0, #recv errors 0

Based on this output, what is the problem?

Trap 1: The IPsec SA is not established; phase 1 is still pending.

The SA is present with a current peer; phase 1 and 2 are complete.

Trap 2: The remote peer is unreachable; the SA is in a dead state.

The SA is still present; if the peer were unreachable, the SA would be deleted or show errors.

Trap 3: The tunnel interface is down; the SA cannot be used.

The output does not show interface state; SA presence suggests tunnel is up.

A
The IPsec SA is not established; phase 1 is still pending.
Why wrong: The SA is present with a current peer; phase 1 and 2 are complete.
B
The tunnel is up but no traffic is being encrypted; the crypto ACL may not match the traffic.
Zero packet counts indicate no traffic has been encapsulated; check the crypto ACL and routing.
C
The remote peer is unreachable; the SA is in a dead state.
Why wrong: The SA is still present; if the peer were unreachable, the SA would be deleted or show errors.
D
The tunnel interface is down; the SA cannot be used.
Why wrong: The output does not show interface state; SA presence suggests tunnel is up.

Question 12easymultiple choice

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa

dst src state conn-id slot status

10.1.1.2        10.1.1.1        QM_IDLE           1    0    ACTIVE

Based on this output, which statement is correct?

Trap 1: IKE phase 2 is complete; the IPsec SA is active.

QM_IDLE is for ISAKMP SA, not IPsec SA; IPsec SA is shown via show crypto ipsec sa.

Trap 2: The ISAKMP SA is in MM_NO_STATE; negotiation has failed.

QM_IDLE is a success state, not a failure state.

Trap 3: The tunnel is down; the SA is in a dead state.

QM_IDLE with ACTIVE status indicates the SA is alive.

A
IKE phase 1 is complete; the ISAKMP SA is established.
QM_IDLE means the SA is up and ready for quick mode (phase 2).
B
IKE phase 2 is complete; the IPsec SA is active.
Why wrong: QM_IDLE is for ISAKMP SA, not IPsec SA; IPsec SA is shown via show crypto ipsec sa.
C
The ISAKMP SA is in MM_NO_STATE; negotiation has failed.
Why wrong: QM_IDLE is a success state, not a failure state.
D
The tunnel is down; the SA is in a dead state.
Why wrong: QM_IDLE with ACTIVE status indicates the SA is alive.

Question 13mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show crypto ipsec sa peer 10.1.1.2
interface: Tunnel0
    Crypto map tag: VPN-MAP, local addr 10.1.1.1

protected vrf: (none) local ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) current_peer 10.1.1.2 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 100, #pkts encrypt: 100, #pkts digest: 100 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #send errors 0, #recv errors 0

Based on this output, what is the problem?

Trap 1: The tunnel is working correctly; all packets are being encrypted…

Inbound counters are zero, indicating no decryption is happening.

Trap 2: The local crypto ACL is misconfigured; it is not matching traffic.

Outbound packets are being encapsulated, so the ACL is matching.

Trap 3: The IPsec SA is not established; the tunnel is down.

The SA is present and active; packets are being sent.

A
The tunnel is working correctly; all packets are being encrypted and decrypted.
Why wrong: Inbound counters are zero, indicating no decryption is happening.
B
The remote peer is not sending traffic back; check routing on the remote router.
Outbound packets are being sent but none received; the remote side may not have a route back or the crypto ACL is misconfigured.
C
The local crypto ACL is misconfigured; it is not matching traffic.
Why wrong: Outbound packets are being encapsulated, so the ACL is matching.
D
The IPsec SA is not established; the tunnel is down.
Why wrong: The SA is present and active; packets are being sent.

Question 14easymultiple choice

A network engineer runs the following command on Router R1:

R1# show crypto isakmp policy

Global IKE policy Protection suite of priority 10 encryption algorithm: AES - Advanced Encryption Standard (256 bit keys). hash algorithm: Secure Hash Standard 2 (SHA256) authentication method: Pre-Shared Key Diffie-Hellman group: #14 (2048 bit) lifetime: 86400 seconds, no volume limit

Protection suite of priority 20 encryption algorithm: AES - Advanced Encryption Standard (128 bit keys). hash algorithm: Secure Hash Standard 2 (SHA256) authentication method: Pre-Shared Key Diffie-Hellman group: #14 (2048 bit) lifetime: 86400 seconds, no volume limit

Based on this output, which statement is correct?

Trap 1: The router has no IKE policies configured; the output is empty.

Two policies are clearly shown.

Trap 2: The router uses certificate-based authentication.

The authentication method is Pre-Shared Key.

Trap 3: The Diffie-Hellman group is group 2 (1024 bit).

Group 14 is 2048 bit.

A
The router has two IKE policies configured; policy 10 will be preferred.
Lower priority number is preferred; policy 10 with AES-256 will be tried first.
B
The router has no IKE policies configured; the output is empty.
Why wrong: Two policies are clearly shown.
C
The router uses certificate-based authentication.
Why wrong: The authentication method is Pre-Shared Key.
D
The Diffie-Hellman group is group 2 (1024 bit).
Why wrong: Group 14 is 2048 bit.

Question 15easymultiple choice

A network engineer runs the following command on Router R1:

R1# show crypto ipsec transform-set

Transform set ESP-AES256-SHA: { esp-256-aes esp-sha256-hmac } will negotiate = { Tunnel, },

Transform set ESP-AES128-SHA: { esp-aes esp-sha256-hmac } will negotiate = { Tunnel, },

Based on this output, which statement is correct?

Trap 1: The transform sets use transport mode.

The output shows 'Tunnel' mode.

Trap 2: The transform sets use MD5 for hashing.

They use SHA256, not MD5.

Trap 3: The transform sets are not compatible with IKEv2.

They are compatible with both IKEv1 and IKEv2.

A
Both transform sets use tunnel mode; ESP-AES256-SHA uses stronger encryption.
ESP-AES256-SHA uses 256-bit AES, which is stronger than 128-bit.
B
The transform sets use transport mode.
Why wrong: The output shows 'Tunnel' mode.
C
The transform sets use MD5 for hashing.
Why wrong: They use SHA256, not MD5.
D
The transform sets are not compatible with IKEv2.
Why wrong: They are compatible with both IKEv1 and IKEv2.

Question 16mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show crypto map
Crypto Map "VPN-MAP" 10 ipsec-isakmp

Peer = 10.1.1.2 Extended IP access list 100

access-list 100 permit ip 10.1.1.0 0.0.0.255 192.168.1.0 0.0.0.255

Current peer: 10.1.1.2 Security association lifetime: 4608000 kilobytes/3600 seconds PFS (Y/N): N Transform sets={ESP-AES256-SHA,}

Interfaces using crypto map VPN-MAP:

Tunnel0

Based on this output, which statement is correct?

Trap 1: Perfect Forward Secrecy (PFS) is enabled.

PFS is set to 'N' (no).

Trap 2: The crypto map uses dynamic IPsec peer discovery.

The peer is statically configured as 10.1.1.2.

Trap 3: The crypto map is not applied to any interface.

It is applied to Tunnel0.

A
The crypto map is applied to interface Tunnel0 and uses ACL 100 to define interesting traffic.
The output shows Tunnel0 uses this crypto map and ACL 100 defines the traffic.
B
Perfect Forward Secrecy (PFS) is enabled.
Why wrong: PFS is set to 'N' (no).
C
The crypto map uses dynamic IPsec peer discovery.
Why wrong: The peer is statically configured as 10.1.1.2.
D
The crypto map is not applied to any interface.
Why wrong: It is applied to Tunnel0.

Question 17mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show crypto ipsec sa | include pkts

#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0

Based on this output, what is the problem?

Trap 1: The IPsec SA is not established; the tunnel is down.

The SA may be established but no traffic is flowing; the output does not show SA state.

Trap 2: The tunnel is working correctly; all packets are being encrypted.

Zero packets means nothing is being encrypted.

Trap 3: The remote peer is not responding; the SA is in MM_NO_STATE.

The SA might be up; zero packets do not indicate peer unresponsiveness.

A
The IPsec SA is not established; the tunnel is down.
Why wrong: The SA may be established but no traffic is flowing; the output does not show SA state.
B
No interesting traffic is being sent through the tunnel; check the crypto ACL and routing.
Zero packet counts indicate no traffic matches the crypto ACL or routing is not directing traffic to the tunnel.
C
The tunnel is working correctly; all packets are being encrypted.
Why wrong: Zero packets means nothing is being encrypted.
D
The remote peer is not responding; the SA is in MM_NO_STATE.
Why wrong: The SA might be up; zero packets do not indicate peer unresponsiveness.

Question 18mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa detail

Codes: C - IKEv1, I - IKEv2

C-id Local Remote I-VRF Status Encr Hash Auth DH Lifetime Cap 1 10.1.1.1 10.1.1.2 ACTIVE aes sha psk 14 23:59:59

Based on this output, which statement is correct?

Trap 1: The IKEv2 SA is established with the peer 10.1.1.2.

The code 'C' indicates IKEv1, not IKEv2.

Trap 2: The ISAKMP SA is not established; status is MM_NO_STATE.

Status is ACTIVE, meaning it is established.

Trap 3: The Diffie-Hellman group is group 2.

The DH group is 14.

A
The IKEv1 SA is established with the peer 10.1.1.2.
The 'C' code indicates IKEv1, and the status is ACTIVE.
B
The IKEv2 SA is established with the peer 10.1.1.2.
Why wrong: The code 'C' indicates IKEv1, not IKEv2.
C
The ISAKMP SA is not established; status is MM_NO_STATE.
Why wrong: Status is ACTIVE, meaning it is established.
D
The Diffie-Hellman group is group 2.
Why wrong: The DH group is 14.

Question 19mediummultiple choice

Given the following partial configuration on router R1:

crypto isakmp policy 10

encryption aes 256 authentication pre-share group 14 lifetime 86400 !

crypto isakmp key cisco123 address 192.168.1.2

crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac

mode tunnel !

crypto map CMAP 10 ipsec-isakmp

set peer 192.168.1.2 set transform-set TSET match address 101 !

interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 crypto map CMAP

access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

What is the effect of this configuration?

Trap 1: The tunnel will only be established if the peer initiates first.

The configuration allows either side to initiate, as long as interesting traffic is detected.

Trap 2: The transform set uses AES 256 with MD5 authentication, which is…

The transform set uses esp-sha-hmac, which is SHA, not MD5.

Trap 3: ISAKMP lifetime is set to 86400 seconds, which is too short for a…

86400 seconds (24 hours) is a common default and acceptable for site-to-site VPNs.

A
IPsec tunnel is established when traffic from 10.1.1.0/24 to 10.2.2.0/24 triggers it.
ACL 101 defines interesting traffic; once matched, IKE and IPsec negotiations begin.
B
The tunnel will only be established if the peer initiates first.
Why wrong: The configuration allows either side to initiate, as long as interesting traffic is detected.
C
The transform set uses AES 256 with MD5 authentication, which is incorrect.
Why wrong: The transform set uses esp-sha-hmac, which is SHA, not MD5.
D
ISAKMP lifetime is set to 86400 seconds, which is too short for a site-to-site VPN.
Why wrong: 86400 seconds (24 hours) is a common default and acceptable for site-to-site VPNs.

Question 20mediummultiple choice

Consider the following configuration on router R2:

crypto isakmp policy 10

encryption aes 256 authentication pre-share group 14 lifetime 3600 !

crypto isakmp key secretkey address 192.168.1.1

crypto ipsec transform-set TSET esp-aes 256 esp-sha-hmac

mode tunnel !

crypto map CMAP 10 ipsec-isakmp

set peer 192.168.1.1 set transform-set TSET match address 101 !

interface GigabitEthernet0/1
 ip address 192.168.1.2 255.255.255.0
 crypto map CMAP

access-list 101 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255

Which statement is true?

Trap 1: The IPsec tunnel will establish successfully because the transform…

Even though transform sets match, the ISAKMP lifetime mismatch will prevent IKE phase 1 completion.

Trap 2: The tunnel will work but will rekey every hour due to the shorter…

The tunnel cannot establish at all because IKE phase 1 fails.

Trap 3: The pre-shared key mismatch will cause the tunnel to fail.

Both sides use the same key 'secretkey', so that is not an issue.

A
The IPsec tunnel will establish successfully because the transform sets match.
Why wrong: Even though transform sets match, the ISAKMP lifetime mismatch will prevent IKE phase 1 completion.
B
The IKE phase 1 will fail due to ISAKMP lifetime mismatch.
ISAKMP policies must match exactly, including lifetime. A mismatch causes negotiation failure.
C
The tunnel will work but will rekey every hour due to the shorter lifetime.
Why wrong: The tunnel cannot establish at all because IKE phase 1 fails.
D
The pre-shared key mismatch will cause the tunnel to fail.
Why wrong: Both sides use the same key 'secretkey', so that is not an issue.