300-730 · Question #193
Refer to the following configuration exhibit. Which action resolves the issue? `` aaa authentication login EAP_AUTHc local aaa authorization exec default local aaa authorization network EAP_AUTHc…
The correct answer is D. Replace self-signed certificate with a valid certificate. The IKEv2 profile uses RSA signature authentication backed by a self-signed certificate, which AnyConnect clients cannot trust by default, requiring replacement with a valid CA-signed certificate.
Question
aaa authentication login EAP_AUTHc local
aaa authorization exec default local
aaa authorization network EAP_AUTHc local
crypto pki trustpoint TP_AnyConnect
enrollment selfsigned
usage ike
serial-number none
fqdn Router.com
ipaddress none
subject-name cner01.companyx.com
subject-alt-name r01.companyx.com
revocation-check none
state-pair AnyConnect
crypto ikev2 profile AC_EAP
match identity remote key-id "$AnyConnectClients$"
authentication local rsa-sig
authentication remote anyconnect-eap aggregate
pki trustpoint TP_AnyConnect
aaa authentication anyconnect-eap EAP_AUTHc
aaa authorization group anyconnect-eap IKE_EAP_AUTHZ ikev2-auth-policy
aaa authorization user anyconnect-eap cached
no crypto ikev2 http-url cert
Options
- AUse symmetric keys in ikev2 profile.
- BChange Secure Client IKE identity to "$Default$".
- CEnable crypto ikev2 http-url cert.
- DReplace self-signed certificate with a valid certificate.
How the community answered
(37 responses)- A14% (5)
- B24% (9)
- C8% (3)
- D54% (20)
Why each option
The IKEv2 profile uses RSA signature authentication backed by a self-signed certificate, which AnyConnect clients cannot trust by default, requiring replacement with a valid CA-signed certificate.
Switching to symmetric keys would change the authentication method from RSA signatures to pre-shared keys, contradicting the existing PKI-based design and not resolving the certificate trust issue.
'$AnyConnectClients$' is the correct and standard IKE key-id used to match remote AnyConnect identities in an IKEv2 profile; '$Default$' is not a valid identifier for this use case.
The 'crypto ikev2 http-url cert' command enables certificate retrieval via HTTP URL for CRL validation, but the core problem is that the self-signed certificate is not trusted by connecting clients, not a retrieval method issue.
The IKEv2 profile configures 'authentication local rsa-sig', meaning the router presents its certificate to authenticate with AnyConnect clients. The trustpoint 'TP_AnyConnect' is configured with 'enrollment selfsigned', generating a self-signed certificate that is not in any standard trust store on client devices. Replacing it with a certificate issued by a trusted Certificate Authority allows AnyConnect clients to validate the server identity and successfully complete IKEv2 authentication.
Concept tested: IKEv2 AnyConnect profile PKI certificate trust requirements
Source: https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/115036-anyconnect-ikev2-00.html
Topics
Community Discussion
No community discussion yet for this question.