PCNSE Secure Access and VPN Practice Question
Exhibit
admin@PA-5000> show vpn ipsec-sa Total IPsec SA: 3 Gateway: VPN-GW-1, Tunnel-id: 1, State: active, SPI: 123456, Encapsulation: tunnel Gateway: VPN-GW-2, Tunnel-id: 2, State: init, SPI: 0, Encapsulation: tunnel Gateway: VPN-GW-3, Tunnel-id: 3, State: active, SPI: 789012, Encapsulation: transport Configuration for VPN-GW-2: set network tunnel ipsec ipsec-crypto VPN-GW-2 ike-gateway VPN-GW-2-IKE set network tunnel ipsec ipsec-crypto VPN-GW-2 esp-authentication sha1 set network tunnel ipsec ipsec-crypto VPN-GW-2 esp-encryption aes128 set network tunnel ipsec ipsec-crypto VPN-GW-2 lifetime 3600 set network ike gateway VPN-GW-2-IKE version ikev1 set network ike gateway VPN-GW-2-IKE protocol-version ikev1 set network ike gateway VPN-GW-2-IKE peer-address 10.1.1.1 set network ike gateway VPN-GW-2-IKE pre-shared-key mykey set network ike gateway VPN-GW-2-IKE local-address 10.1.1.2 set network ike gateway VPN-GW-2-IKE local-id 10.1.1.2 set network ike gateway VPN-GW-2-IKE peer-id 10.1.1.1 set network tunnel ipsec ipsec-crypto VPN-GW-2 proxy-id local-ip 192.168.1.0/24 set network tunnel ipsec ipsec-crypto VPN-GW-2 proxy-id remote-ip 192.168.2.0/24
A site-to-site IPsec tunnel between two Palo Alto Networks firewalls is not passing traffic. The administrator runs the 'show vpn ipsec-sa' command and sees the output in the exhibit. The remote peer is configured to use IKEv2 only. Based on the configuration, what is the most likely cause of the tunnel being in 'init' state?
⚠ Common exam trap
Test-takers frequently assume 'init' state always indicates a pre-shared key mismatch or proxy ID issue, but in this scenario the IKE version mismatch is the root cause because the tunnel never progresses past the initial IKE exchange.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IKE version is incompatible.
The 'init' state in the 'show vpn ipsec-sa' output indicates that the IPsec Security Association (SA) has not been established because the IKE phase 1 negotiation failed. Since the remote peer is configured to use IKEv2 only, and the local firewall is likely configured for IKEv1 (or both, but not matching), the IKE version mismatch prevents the initial key exchange. This is the most direct cause of the tunnel remaining in 'init' state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The IKE version is incompatible.
Why this is correct
Local uses IKEv1, remote expects IKEv2; Phase 1 negotiation fails, resulting in 'init' state.
- ✗
The pre-shared key is incorrect.
Why it's wrong here
An incorrect PSK would cause IKE authentication failure, but the remote peer's IKE version is explicitly stated as IKEv2 only, making this less likely.
- ✗
The proxy IDs are mismatched with the peer.
Why it's wrong here
Proxy ID mismatch causes Phase 2 failure, not Phase 1; the tunnel would show 'active' for Phase 1.
- ✗
The IPsec crypto profile lifetime is too short.
Why it's wrong here
Lifetime settings affect re-keying, not initial SA establishment.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.