300-730 · Question #54
Which command is used to troubleshoot an IPv6 FlexVPN spoke-to-hub connectivity failure?
The correct answer is A. show crypto ikev2 sa. FlexVPN uses IKEv2 as its control plane, so IKEv2-specific show commands are required to diagnose connectivity failures between spokes and the hub.
Question
Options
- Ashow crypto ikev2 sa
- Bshow crypto isakmp sa
- Cshow crypto vpn
- Dshow crypto identity
How the community answered
(28 responses)- A93% (26)
- B4% (1)
- D4% (1)
Why each option
FlexVPN uses IKEv2 as its control plane, so IKEv2-specific show commands are required to diagnose connectivity failures between spokes and the hub.
FlexVPN is built exclusively on IKEv2, not IKEv1. The 'show crypto ikev2 sa' command displays the IKEv2 Security Associations and their negotiation state, making it the correct tool to diagnose an IPv6 FlexVPN spoke-to-hub failure. This command reveals whether the IKEv2 tunnel is in an established state or where the negotiation is failing.
'show crypto isakmp sa' is used for IKEv1/ISAKMP-based VPNs such as classic DMVPN, not for FlexVPN which exclusively uses IKEv2.
'show crypto vpn' is not a valid Cisco IOS command and will not return any meaningful output for troubleshooting.
'show crypto identity' displays IKEv2 identity profiles and is not used to verify SA state or diagnose spoke-to-hub connectivity failures.
Concept tested: FlexVPN IKEv2 SA troubleshooting commands
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ikevpn/configuration/xe-16/sec-ike-for-ipsec-vpns-xe-16-book/sec-cfg-ikev2-flex.html
Topics
Community Discussion
No community discussion yet for this question.