300-730 · Question #218
Which debug command should be used to verify that a spoke router is sending UDP 500 packet when troubleshooting DMVPN?
The correct answer is B. debug crypto isakmp. UDP 500 is the port used by IKE/ISAKMP for key negotiation in DMVPN tunnels. The 'debug crypto isakmp' command reveals whether UDP 500 packets are being generated and exchanged during Phase 1 negotiation.
Question
Options
- Adebug crypto dmvpn
- Bdebug crypto isakmp
- Cdebug crypto udp packet
- Ddebug crypto ipsec
How the community answered
(29 responses)- A7% (2)
- B86% (25)
- C3% (1)
- D3% (1)
Why each option
UDP 500 is the port used by IKE/ISAKMP for key negotiation in DMVPN tunnels. The 'debug crypto isakmp' command reveals whether UDP 500 packets are being generated and exchanged during Phase 1 negotiation.
'debug crypto dmvpn' shows NHRP and DMVPN tunnel events but does not specifically surface UDP 500 IKE packet activity.
IKE (ISAKMP) uses UDP port 500 to negotiate security associations during Phase 1. The 'debug crypto isakmp' command displays the ISAKMP negotiation messages sent and received over UDP 500, making it the correct tool to verify that a spoke is generating and transmitting those packets toward the hub.
'debug crypto udp packet' is not a valid Cisco IOS debug command and does not exist in standard IOS syntax.
'debug crypto ipsec' reveals IPsec Phase 2 SA negotiation details, not the Phase 1 IKE/UDP 500 exchange.
Concept tested: Troubleshooting DMVPN IKE Phase 1 UDP 500 traffic
Source: https://www.cisco.com/c/en/us/support/docs/security/dynamic-multipoint-vpn-dmvpn/111976-dmvpn-troubleshoot-00.html
Topics
Community Discussion
No community discussion yet for this question.