nerdexam
Cisco

300-730 · Question #127

An engineer has successfully established a Phase 1 and Phase 2 tunnel between two sites. Site A has internal subnet 192.168.0.0/24 and Site B has internal subnet 10.0.0.0/24. The engineer notices…

The correct answer is C. Allow protocol ESP or AH on the firewall in front of the Site B router. The firewall in front of Site B is blocking ESP protocol packets from Site A, so the Site B router never receives the encrypted traffic and its decrypt counters stay at zero.

Troubleshooting VPNs

Question

An engineer has successfully established a Phase 1 and Phase 2 tunnel between two sites. Site A has internal subnet 192.168.0.0/24 and Site B has internal subnet 10.0.0.0/24. The engineer notices that no packets are decrypted at Site B. Pings to 192.168.0.0 from internal Site B devices make it to the Site B router, and the Site A router has incrementing encrypt and decrypt counters. What must be done to ensure bidirectional communication between both sites?

Options

  • AModify the routing at Site B so that traffic is sent to Site A.
  • BConfigure the correct DH group on both devices.
  • CAllow protocol ESP or AH on the firewall in front of the Site B router.
  • DEnable PFS on the headend device.

How the community answered

(38 responses)
  • A
    11% (4)
  • B
    5% (2)
  • C
    68% (26)
  • D
    16% (6)

Why each option

The firewall in front of Site B is blocking ESP protocol packets from Site A, so the Site B router never receives the encrypted traffic and its decrypt counters stay at zero.

AModify the routing at Site B so that traffic is sent to Site A.

Routing at Site B is confirmed correct because pings from Site B internal devices reach the Site B router, eliminating a routing problem as the cause.

BConfigure the correct DH group on both devices.

A DH group mismatch would prevent Phase 2 from establishing at all; since both Phase 1 and Phase 2 are already up, the DH configuration is valid on both sides.

CAllow protocol ESP or AH on the firewall in front of the Site B router.Correct

IPsec data-plane traffic is carried by ESP (IP protocol 50) or AH (IP protocol 51), which are not TCP or UDP and must be explicitly permitted in firewall rules. Because Site A shows incrementing decrypt counters, it is receiving encrypted packets from Site B, but the firewall in front of the Site B router is dropping the ESP packets sent by Site A before they can reach the router, explaining why Site B has no decryption activity. Permitting ESP or AH inbound on that firewall allows the encrypted return traffic to reach the Site B router.

DEnable PFS on the headend device.

PFS affects the security of Phase 2 rekeying sessions and does not determine whether packets in an already-established tunnel are decrypted.

Concept tested: Firewall ESP/AH protocol permit for IPsec traffic

Source: https://www.cisco.com/c/en/us/support/docs/security-sdwan/ipsec/5409-ipsec-through-nats.html

Topics

#IPsec#ESP#firewall filtering#bidirectional traffic

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-730 Practice