nerdexam
Cisco

300-730 · Question #106

Refer to the exhibit. A TCP based application that should be accessible over the VPN tunnel is not working! Pings to the appropriate IP address are failing. Based on the output, what is a fix for…

The correct answer is A. Add a route on the remote peer for 209.165.201.0/27. Pings failing across a VPN tunnel typically indicate a missing return route; the remote peer must have a route to the originating subnet to send replies back through the tunnel.

Troubleshooting VPNs

Question

Refer to the exhibit. A TCP based application that should be accessible over the VPN tunnel is not working! Pings to the appropriate IP address are failing. Based on the output, what is a fix for this issue?

Options

  • AAdd a route on the remote peer for 209.165.201.0/27.
  • BAdd a route on the local peer for 10.1.1.0/24.
  • CAdd a permit for TCP traffic going to 10.1.1.0/24.
  • DAdd a permit for TCP traffic going to 209.165.201.0/27.

How the community answered

(60 responses)
  • A
    68% (41)
  • B
    5% (3)
  • C
    10% (6)
  • D
    17% (10)

Why each option

Pings failing across a VPN tunnel typically indicate a missing return route; the remote peer must have a route to the originating subnet to send replies back through the tunnel.

AAdd a route on the remote peer for 209.165.201.0/27.Correct

The remote peer lacks a route to 209.165.201.0/27, which is the source network on the local side. Without this route, the remote peer cannot forward reply traffic back through the VPN tunnel. Adding this route establishes symmetric routing and allows both ICMP and TCP sessions to complete.

BAdd a route on the local peer for 10.1.1.0/24.

The local peer is the source of traffic and already has a path to its own connected or configured network; adding a route to 10.1.1.0/24 on the local peer does not fix the missing return path on the remote side.

CAdd a permit for TCP traffic going to 10.1.1.0/24.

The failure is a routing problem, not an access control issue; a missing ACL permit for TCP does not explain why ICMP pings are also failing.

DAdd a permit for TCP traffic going to 209.165.201.0/27.

Adding a permit for TCP to 209.165.201.0/27 addresses ACL policy, not the missing route needed for the remote peer to return traffic through the tunnel.

Concept tested: VPN tunnel routing - missing return route on remote peer

Source: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/98069-asa-vpn-debug.html

Topics

#site-to-site VPN#routing#crypto ACL#traffic flow

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-730 Practice