Refer to the exhibit. An engineer must configure an IPsec VPN connection between site 1 and site 2. The indicated configuration was applied to router R1; however, the tunnel fails to come up. Which…

The correct answer is B. set peer 192.168.20.2. For a site-to-site IPsec VPN, each peer must point to the reachable IP address of the remote VPN endpoint--that is, the IP address on the WAN/Internet-facing interface of the remote router. From the diagram: R1 outside (toward Internet): 192.168.10.1 R2 outside (toward…

Managing and Operating Cisco SP Network

Question

Refer to the exhibit. An engineer must configure an IPsec VPN connection between site 1 and site 2. The indicated configuration was applied to router R1; however, the tunnel fails to come up. Which command must be run on R1 to resolve the issue?

Exhibit

Options

Aset peer 10.1.0.1
Bset peer 192.168.20.2
Cset peer 192.168.10.1
Dset peer 10.2.0.1

How the community answered

(26 responses)

A
8% (2)
B
77% (20)
C
4% (1)
D
12% (3)

Explanation

For a site-to-site IPsec VPN, each peer must point to the reachable IP address of the remote VPN endpoint--that is, the IP address on the WAN/Internet-facing interface of the remote router. From the diagram: R1 outside (toward Internet): 192.168.10.1 R2 outside (toward Internet): 192.168.20.2 Site 1: 10.1.0.0/24 Site 2: 10.2.0.0/24 The crypto map on R1 uses: crypto map mymap 10 ipsec-isakmp set transform-set myset match address 101 set peer <REMOTE_PEER_IP> The <REMOTE_PEER_IP> must be the IP address where R1 can actually reach the IPsec peer, which is R2's Internet-facing interface 192.168.20.2. If the peer were configured with a LAN IP such as 10.2.0.1 (site 2's internal gateway), IKE packets would never reach the remote router because that address is not routable over the Therefore, the correct command to bring up the VPN is: set peer 192.168.20.2

Topics

#IPsec VPN#crypto map#set peer#tunnel troubleshooting

Community Discussion

No community discussion yet for this question.

Full 300-540 Practice