Refer to the exhibit. Based on the debug output, which type of mismatch is preventing the VPN from coming up?

The correct answer is A. interesting traffic. Interesting traffic refers to the traffic selectors defined in the crypto ACL (access list) on each VPN peer. These ACLs must be mirror images of each other - what one side defines as source/destination, the other must define as destination/source. When the debug output shows…

Troubleshooting Using ASDM and CLI

Question

Refer to the exhibit. Based on the debug output, which type of mismatch is preventing the VPN from coming up?

Options

Ainteresting traffic
Blifetime
Cpreshared key
DPFS

How the community answered

(22 responses)

A
59% (13)
B
14% (3)
C
23% (5)
D
5% (1)

Explanation

Interesting traffic refers to the traffic selectors defined in the crypto ACL (access list) on each VPN peer. These ACLs must be mirror images of each other - what one side defines as source/destination, the other must define as destination/source. When the debug output shows IKE Phase 1 completing successfully but Phase 2 (IPsec SA) failing, the most common cause is a traffic selector mismatch. The debug will typically show a NOTIFY message or a proxy ID mismatch, indicating the peers cannot agree on which subnets to encrypt. Lifetime mismatches (B) cause a negotiation fallback but rarely prevent the tunnel from forming. Preshared key mismatches (C) fail in Phase 1, not Phase 2. PFS mismatches (D) also occur in Phase 2 but produce a specific PFS/DH group mismatch message rather than a proxy ID error.

Topics

#crypto ACL#interesting traffic#IKE negotiation#debug output

Community Discussion

No community discussion yet for this question.

Full 300-730 Practice