nerdexam
Cisco

300-730 · Question #24

Refer to the exhibit: ASA-4-751015 Local:0.0.0.0:0 Remote:0.0.0.0:0 Username:Unknown SA request rejected by CAC. Reason: IN-NEGOTIATION SA LIMIT REACHED A customer cannot establish an IKEv2…

The correct answer is B. Increase the maximum SA limit on the local Cisco ASA. The ASA syslog message indicates that the local device rejected a new IKEv2 SA request because the in-negotiation SA limit enforced by Call Admission Control (CAC) has been reached.

Troubleshooting VPNs

Question

Refer to the exhibit: ASA-4-751015 Local:0.0.0.0:0 Remote:0.0.0.0:0 Username:Unknown SA request rejected by CAC. Reason: IN-NEGOTIATION SA LIMIT REACHED A customer cannot establish an IKEv2 site-to-site VPN tunnel between two Cisco ASA devices. Based on the syslog message, which action brings up the VPN tunnel?

Exhibit

300-730 question #24 exhibit

Options

  • AReduce the maximum SA limit on the local Cisco ASA.
  • BIncrease the maximum SA limit on the local Cisco ASA.
  • CRemove the maximum SA limit on the remote Cisco ASA.
  • DCorrect the crypto access list on both Cisco ASA devices.

How the community answered

(40 responses)
  • A
    8% (3)
  • B
    75% (30)
  • C
    3% (1)
  • D
    15% (6)

Why each option

The ASA syslog message indicates that the local device rejected a new IKEv2 SA request because the in-negotiation SA limit enforced by Call Admission Control (CAC) has been reached.

AReduce the maximum SA limit on the local Cisco ASA.

Reducing the maximum SA limit would lower the threshold further, preventing even more negotiations from succeeding and making the problem worse.

BIncrease the maximum SA limit on the local Cisco ASA.Correct

The message 'IN-NEGOTIATION SA LIMIT REACHED' means the local ASA's CAC policy has hit its configured ceiling for concurrent SA negotiations. Increasing the limit using the 'crypto ikev2 limit max-in-negotiation-sa' command on the local ASA allows the device to accept additional simultaneous IKEv2 negotiation requests and bring up the VPN tunnel.

CRemove the maximum SA limit on the remote Cisco ASA.

The syslog is generated by the local ASA and explicitly identifies a local CAC rejection - the remote ASA's SA limit is not the source of this error.

DCorrect the crypto access list on both Cisco ASA devices.

The rejection reason is a CAC negotiation limit, not a traffic selector mismatch; correcting the crypto ACL addresses proxy identity errors, not SA count limits.

Concept tested: ASA IKEv2 CAC in-negotiation SA limit configuration

Source: https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/C/asa-command-ref-C.html

Topics

#IKEv2#SA limit#CAC#syslog troubleshooting

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-730 Practice