300-730 · Question #132
Which remote access VPN technology requires the use of the IPsec-proposal configuration option?
The correct answer is C. IKEv2-based VPN. The 'ipsec-proposal' configuration construct is used exclusively with IKEv2 on Cisco ASA to define IPsec transform parameters for remote access VPN.
Question
Options
- Aclientless SSLVPN
- BSSLVPN Full Tunnel
- CIKEv2-based VPN
- DIKEv1-based VPN
How the community answered
(34 responses)- A6% (2)
- B3% (1)
- C88% (30)
- D3% (1)
Why each option
The 'ipsec-proposal' configuration construct is used exclusively with IKEv2 on Cisco ASA to define IPsec transform parameters for remote access VPN.
Clientless SSL VPN operates over TLS at the application layer and does not establish an IPsec tunnel, so ipsec-proposal configuration is not applicable.
SSL VPN Full Tunnel uses TLS to encapsulate all traffic without IPsec, and its configuration uses SSL policies rather than ipsec-proposal objects.
Cisco ASA IKEv2 configuration uses a dedicated 'crypto ikev2 ipsec-proposal' object to specify encryption and integrity algorithms for IPsec security associations. This object is then referenced in IKEv2 group policies or connection profiles, and is a required element of the IKEv2 VPN configuration hierarchy that does not exist in IKEv1 syntax.
IKEv1 VPN uses 'crypto ipsec transform-set' to define IPsec parameters, not the ipsec-proposal syntax, which was introduced as part of the IKEv2 configuration model.
Concept tested: IKEv2 ipsec-proposal configuration on Cisco ASA
Source: https://www.cisco.com/c/en/us/td/docs/security/asa/asa94/configuration/vpn/asa-94-vpn-config/vpn-ikev2.html
Topics
Community Discussion
No community discussion yet for this question.