300-730 · Question #170
Refer to the exhibit. Which action must be taken on the IPsec tunnel configuration to resolve the issue? [Exhibit: Console output showing IPsec error messages] `` March 09 09:39:15:945 : IPsec(validat
The correct answer is A. The access lists on each peer must mirror each other.. The 'proxy identities not supported' error indicates IPsec ACLs on the two peers do not correspond correctly - each peer's ACL must be the mirror image of the other, with source and destination networks swapped.
Question
March 09 09:39:15:945 : IPsec(validate_transform_proposal): proxy identities not supported
March 09 09:39:16:363 : IPsec policy invalidated proposal
March 09 09:39:16:768 : SA not acceptable!
Options
- AThe access lists on each peer must mirror each other.
- BThe transform set on each peer must match.
- CThe access lists on each peer must be identical.
- DThe transform set on each peer must be identical.
How the community answered
(34 responses)- A76% (26)
- B9% (3)
- C12% (4)
- D3% (1)
Why each option
The 'proxy identities not supported' error indicates IPsec ACLs on the two peers do not correspond correctly - each peer's ACL must be the mirror image of the other, with source and destination networks swapped.
In IPsec, proxy identities define the traffic selectors each peer advertises during Phase 2 negotiation, and these are derived from the crypto ACLs. When Peer A encrypts traffic from Network X to Network Y, Peer B must have an ACL matching traffic from Network Y to Network X - a mirror relationship. Mismatched proxy identities produce the exact 'proxy identities not supported' and 'SA not acceptable' errors shown in the output.
A transform set mismatch causes negotiation failures related to encryption or hashing algorithm proposals and produces different error messages than the proxy identity errors shown.
Identical ACLs on both peers still result in a proxy identity mismatch because the source and destination must be swapped between peers, not duplicated.
Transform set issues cause IKE Phase 2 cipher/hash algorithm rejection errors, not the proxy identity validation failure shown in the exhibit.
Concept tested: IPsec proxy identity ACL mirroring between peers
Source: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409-ipsec-debug-00.html
Topics
Community Discussion
No community discussion yet for this question.