PCNSE Secure Access and VPN Practice Question
An IPSec tunnel between two PA firewalls fails to establish. On the initiator, 'show vpn ipsec-sa' shows no SAs. Which debug command would provide the most detailed information about IKE negotiation?
⚠ Common exam trap
Many candidates confuse 'debug flow basic' (data-plane) with IKE debugging (control-plane), or assume 'show counter global' will reveal negotiation failures, when in fact counters only track post-establishment statistics and not the IKE handshake itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
debug ike global on
'debug ike global on' enables detailed IKE (Internet Key Exchange) debugging on Palo Alto firewalls, capturing Phase 1 and Phase 2 negotiation messages, including proposal mismatches, authentication failures, and timeout errors. Since no IPsec SAs exist, the issue lies in IKE negotiation, and this command provides the most granular, real-time output to diagnose why the tunnel fails to establish.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
show counter global | match ipsec
Why it's wrong here
Global counters aggregate packet and drop statistics per feature; they never expose IKEv2 payload contents, proposal mismatches or nonce exchanges. It is tempting because counters quickly reveal whether IKE packets arrive or are dropped, which is useful for confirming basic reachability before deeper troubleshooting.
- ✗
show log system
Why it's wrong here
System logs record discrete events such as tunnel up/down and commit results, not the step-by-step IKEv2 exchange detail needed to find a proposal or authentication mismatch. It is tempting because logs are the quickest first check, and would be the right choice for confirming whether the tunnel ever came up.
- ✓
debug ike global on
Why this is correct
With no IPsec SAs present, the failure lies in Phase 1, so IKE negotiation must be examined. The 'debug ike global on' command enables global IKE daemon debugging, exposing payload exchanges, proposal mismatches and authentication failures that explain why the tunnel never reaches quick mode. This targets the negotiation stage the stem identifies as failing.
- ✗
debug flow basic
Why it's wrong here
debug flow basic traces session packet-path decisions such as routing, NAT and policy lookups, but it does not decode IKEv2 payloads or proposal exchanges. It is tempting because flow tracing is the standard tool for diagnosing why traffic is dropped, which would be the right choice for a data-plane forwarding failure.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 319 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.