300-540 · Question #5
Refer to the exhibit. An engineer must configure an IPsec VPN connection between site 1 and site 2. The ISAKMP policy for the phase 1 negotiations of the tunnel must use AES and SHA-256. This…
The correct answer is B. encryption aes E. hash sha256. Phase 1 of an IPsec tunnel (ISAKMP/IKE) must have matching proposals on both peers for: Encryption algorithm Hash (integrity) algorithm Authentication method The requirement states that AES and SHA-256 must be used. The current configuration uses: encryption 3des incorrect…
Question
Refer to the exhibit. An engineer must configure an IPsec VPN connection between site 1 and site 2. The ISAKMP policy for the phase 1 negotiations of the tunnel must use AES and SHA-256. This configuration was applied to both PE routers; however, the tunnel fails to come up:
crypto isakmp policy 10 encryption 3des hash md5 authentication pre-share group 12 Which two commands must be run on router PE1 to resolve the issue? (Choose two.)
Exhibit
Options
- Agroup 10
- Bencryption aes
- Cencryption sha256
- Dhash aes
- Ehash sha256
How the community answered
(45 responses)- A13% (6)
- B78% (35)
- C2% (1)
- D7% (3)
Explanation
Phase 1 of an IPsec tunnel (ISAKMP/IKE) must have matching proposals on both peers for: Encryption algorithm Hash (integrity) algorithm Authentication method The requirement states that AES and SHA-256 must be used. The current configuration uses: encryption 3des incorrect (must be AES) hash md5 incorrect (must be SHA-256) To meet the requirement, we must modify the ISAKMP policy: crypto isakmp policy 10 encryption aes change 3DES to AES hash sha256 change MD5 to SHA-256 authentication pre-share Therefore, the necessary commands on PE1 are: encryption aes option B hash sha256 option E
Topics
Community Discussion
No community discussion yet for this question.