300-730 · Question #199
Refer to the exhibit. A new IPsec VPN tunnel has been configured and the security associations do not establish. After running the show crypto isakmp sa command, the output is displayed. What must be
The correct answer is C. pre-shared key. An IKE Main Mode SA stuck in MM_WAIT_MSG_6 indicates a pre-shared key mismatch between the two VPN peers.
Question
Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
IKE Peer: 10.10.10.11
Type: L2L
Rekey: no
Role: initiator
State: MM_WAIT_MSG_6
Options
- Apeer address
- Btransform sets
- Cpre-shared key
- Dkeep-alive values
How the community answered
(36 responses)- A3% (1)
- B8% (3)
- C75% (27)
- D14% (5)
Why each option
An IKE Main Mode SA stuck in MM_WAIT_MSG_6 indicates a pre-shared key mismatch between the two VPN peers.
A wrong peer address would prevent Phase 1 from initiating at all, not produce an active SA stalled at MM_WAIT_MSG_6.
A transform set mismatch causes the SA to fail during an earlier negotiation exchange (MM_WAIT_MSG_2 or MM_WAIT_MSG_4), not at message 6.
In IKE Main Mode, messages 5 and 6 are encrypted and carry SKEYID-based authentication hashes derived from the pre-shared key. If the PSK does not match on both peers, the responder's authentication hash in message 6 will be invalid or absent, leaving the initiator indefinitely waiting in the MM_WAIT_MSG_6 state.
Keep-alive values affect tunnel maintenance after establishment and do not influence the IKE Phase 1 handshake authentication state.
Concept tested: IKE Main Mode Phase 1 pre-shared key mismatch diagnosis
Source: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113972-asa-vpn-syslog-00.html
Topics
Community Discussion
No community discussion yet for this question.