Refer to the exhibit. An IPsec Cisco AnyConnect client is failing to connect and generates these debugs every time a connection to an IOS headend is attempted. Which action resolves this issue?

Question

Options

• ACorrect the DH group setting.
• BCorrect the PFS setting.
• CCorrect the integrity setting.
• DCorrect the encryption setting.

• A
  61% (27)
• B
  20% (9)
• C
  5% (2)
• D
  14% (6)

Explanation

The debug output (visible in the exhibit) shows IKEv2 SA negotiation failing during the initial exchange. The specific failure indicates a mismatch in the Diffie-Hellman (DH) group proposed by the AnyConnect client versus what is configured in the IKE policy on the IOS headend.

During IKEv2 negotiation, both peers must agree on a common DH group (e.g., Group 2/1024-bit, Group 14/2048-bit, Group 19/256-bit ECP, etc.) to establish the shared secret. If the headend's crypto ikev2 proposal specifies a DH group not offered by the client (or vice versa), the SA negotiation fails immediately with a 'NO_PROPOSAL_CHOSEN' or similar error.

Why the other options are wrong:

• B - PFS (Perfect Forward Secrecy) is a Phase 2 / IPsec SA parameter. A PFS mismatch would allow IKEv2 Phase 1 to complete but fail during IPsec SA creation - not during the initial IKE handshake shown in the debug.
• C - An integrity (HMAC) mismatch would show a proposal negotiation failure, but the debug specifically points to the DH group exchange failure.
• D - An encryption mismatch would also cause a proposal failure, but again the debug evidence points to DH group as the culprit.

No community discussion yet for this question.