Refer to the exhibit. An engineer must configure an IPsec VPN connection between site 1 and site 2. The indicated configuration was applied to router R1; however, the tunnel fails to come up. Which…

Question

Exhibit

Options

• Aip route 0.0.0.0 0.0.0.0 10.1.1.2
• Bcrypto isakmp key vpnuser address 192.168.20.2
• Cip route 0.0.0.0 0.0.0.0 192.168.20.2
• Dcrypto isakmp key vpnuser address 10.1.1.2

• A
  7% (3)
• B
  80% (36)
• C
  11% (5)
• D
  2% (1)

Explanation

For a site-to-site IPsec VPN, each peer must configure a pre-shared key tied to the public IP address of the remote VPN peer: crypto isakmp key <KEY> address <REMOTE_PUBLIC_IP> From the diagram: R1 outside IP: 192.168.10.1/24 R2 outside IP: 192.168.20.2/24 remote peer for R1 In the current R1 configuration, the ISAKMP key is incorrectly bound to 192.168.10.2, which is a local next-hop/ISP address on R1's own subnet, not the R2 public IP. Because the pre-shared- key address does not match the source IP of R2's IKE packets, phase 1 negotiation fails and the tunnel never comes up. The correct configuration on R1 must therefore be: crypto isakmp key vpnuser address 192.168.20.2

No community discussion yet for this question.