Secure Access and VPN practice questions

The external gateway is not configured for Kerberos authentication.

Why it fails: The authentication profile is configured on the portal, not the gateway.

The authentication profile is not configured on the gateway.

Why it fails: Kerberos authentication is only needed on the portal; the gateway uses the portal's authentication token.

The GlobalProtect gateway certificate is not trusted by the client.

Why it fails: Certificate trust issues would cause a different error (e.g., untrusted CA), not a Kerberos authentication failure.

Configure the portal to assign the gateway only when the user is external.

Why it fails: The portal can assign gateways based on network location, but the specific configuration is to set gateway to 'None' for internal.

Set the gateway's 'Tunnel Mode' to 'No' for internal users.

Why it fails: Tunnel mode is not used to bypass the firewall; it controls traffic forwarding.

Configure the gateway agent with internal host detection.

Why it fails: Internal host detection on the gateway is used to determine if the client is internal, but it does not prevent gateway assignment.

The tunnel interface is not in a virtual router.

Why it fails: The tunnel interface is automatically placed in the virtual router, so this is unlikely.

The security policy does not allow traffic from the VPN zone.

Why it fails: While a security rule is required, the symptom of no access at all suggests a routing issue, not just a policy block.

The IP pool for the VPN client is exhausted.

Why it fails: If the client receives an IP, the pool is not exhausted.

The tunnel interface is not assigned to a security zone.

Why it fails: An unassigned tunnel interface blocks Phase 2 traffic, but IKE Phase 1 negotiation would still complete and the gateway would show as up. The stem states the tunnel does not come up at all, pointing to a Phase 1 mismatch. Zone assignment matters once IKE is established and traffic must flow.

Dead peer detection (DPD) is not configured.

Why it fails: DPD detects and tears down dead peers on an established tunnel; it does not participate in IKEv2 Phase 1 negotiation. With DPD unset, the tunnel still forms. DPD configuration is the right fix when tunnels hang silently after a peer failure, not when they never come up.

The MTU on the WAN interface is set too low.

Why it fails: MTU issues can cause fragmentation but not failure to establish the tunnel.

The GlobalProtect app's cookie integrity is corrupted.

Why it fails: Cookie integrity is for authentication, not tunnel rekey.

The GlobalProtect client needs to be reinstalled.

Why it fails: Reinstall is not a typical troubleshooting step for rekey failures.

The user-id agent is not resolving usernames correctly.

Why it fails: User-ID does not impact tunnel rekey.

Use user-ID on the GlobalProtect gateway.

Why it fails: User-ID on the gateway is used to map IPs to users, but access control is done via security policies.

Configure group mapping on the GlobalProtect portal.

Why it fails: Group mapping on the portal is for authentication, not access control.

Create a HIP profile and assign it to the gateway.

Why it fails: HIP profiles are for endpoint posture, not user-based access.

Client certificate

Why it fails: Certificates are optional; pre-shared key can be used.

Security zone for the tunnel interface

Why it fails: A security zone is needed for policy enforcement but not for tunnel establishment.

GlobalProtect portal configuration

Why it fails: The portal is used for authentication and client configuration, but not for the tunnel itself.

GlobalProtect Gateway configuration

Why it fails: GlobalProtect Gateway is for remote access VPN, not site-to-site.

SSL VPN using GlobalProtect portal

Why it fails: SSL VPN is for remote access, not site-to-site.

The gateway is not configured with a client IP pool.

Why it fails: The gateway has a client IP pool.

The portal's authentication profile is incorrect.

Why it fails: Authentication is not the issue.

The portal is not configured with internal host detection.

Why it fails: The exhibit shows internal host detection is configured.

Change the IKE version on the hub to IKEv1.

Why it fails: IKE version mismatch would cause a different error.

Reissue the hub firewall's certificate with the correct subject name.

Why it fails: The certificate subject name is not the cause; the negotiation fails due to proposal mismatch.

Ensure the internal CA is reachable from the branch firewalls.

Why it fails: Certificate revocation check is not causing the failure.

Allow: Blocks traffic and sends a TCP reset to the source.

Why it fails: Incorrect — Allow permits traffic; blocking with TCP reset is the action of Deny.

Deny: Silently drops traffic without any notification.

Why it fails: Incorrect — this describes the Drop action, not Deny. Deny sends a TCP reset.

The user's GlobalProtect client software is outdated

Why it fails: An outdated client might cause feature issues but would likely still authenticate.

The gateway's interface is not in the same zone as the portal

Why it fails: Zone assignment does not affect user connectivity once the tunnel is established.

The portal's 'Access' list does not include the user

Why it fails: The portal's access list affects portal authentication only, not gateway access.

The tunnel interface is in the wrong virtual router

Why it fails: Wrong VR would cause routing issues, but IP address is more fundamental.

The tunnel interface is not assigned to a zone

Why it fails: Zone is required for security policy but traffic would still be sent if IP is configured.

The tunnel interface does not have a management profile

Why it fails: Management profile is for administrative access, not data traffic.

Pre-logon token not enabled on the portal

Why it fails: Portal pre-logon token enables the client to store credentials; without it, pre-logon may fail at portal authentication.

Pre-logon token not enabled on the gateway

Why it fails: Gateway pre-logon token is also needed to allow access before user login.

Portal's authentication profile does not allow pre-logon

Why it fails: Portal authentication profile can restrict pre-logon, but users are authenticating successfully to the portal.

Proxy ID mismatch

Why it fails: Proxy ID mismatch causes phase2 failure, but the tunnel state may still show as down.

Tunnel interface IP misconfiguration

Why it fails: IP misconfiguration affects routing but not tunnel state directly.

IKE version mismatch

Why it fails: IKE version mismatch prevents negotiation, but PSK is more commonly misconfigured.

GlobalProtect with pre-logon

Why it fails: GlobalProtect requires the client software.

IPSec VPN

Why it fails: IPSec requires a client or firewall configuration on both ends.

L2TP over IPSec

Why it fails: L2TP also requires client software and is built into some operating systems but not browser-only.

The portal's authentication profile does not pass the OTP to the gateway

Why it fails: The portal does not pass OTP; it authenticates the user and the gateway independently verifies.

The RADIUS server does not return a session timeout

Why it fails: Session timeout affects session duration, not authentication success.

The firewall is not configured to allow RADIUS traffic

Why it fails: If RADIUS traffic were blocked, portal authentication would also fail.

Traffic shaping policy

Why it fails: Traffic shaping is configured on zones, not directly on tunnel interfaces.

Netflow profile

Why it fails: Netflow can be configured on interfaces but is not a standard element; it is optional and not always considered a basic element.

Mismatched IKE version

Why it fails: IKE version mismatch prevents Phase1 from completing, so Phase2 cannot come up. It tempts because version mismatches are a frequent real-world VPN fault, and it would be the right answer if the stem asked why Phase1 is down.

Wrong tunnel interface IP address

Why it fails: Phase2 down stems from proxy-ID, encryption, or lifetime mismatches; a wrong tunnel interface IP breaks Phase1 negotiation or routing, not the Phase2 SA. It tempts because interface addressing is a common VPN misconfiguration, and it would be the answer if Phase1 itself failed to establish.

Incorrect pre-shared key

Why it fails: A wrong pre-shared key fails Phase1 authentication, so Phase2 never negotiates at all. It tempts because PSK mismatches are the classic VPN fault, and it would be correct if the question asked why Phase1 is down rather than Phase2.

The root CA certificate is not imported into the firewall

Why it fails: This is not the most likely cause. Importing the root CA certificate into the firewall is necessary for authenticating client certificates (client authentication), not for validating the portal's server certificate. The error is about server certificate validation, so this would not fix the issue.

The gateway's certificate is not configured

Why it fails: The gateway's certificate is relevant only for the gateway connection, not the initial portal connection. The error occurs when connecting to the portal, so the gateway certificate is not the missing configuration.

The user's client certificate is expired

Why it fails: An expired client certificate would cause a different error related to client authentication, not 'Certificate validation failed' for the portal. The error is about the server certificate, not the client certificate.