Refer to the exhibit. Which type of site-to-site VPN tunnel between two routers is down. Based on the debug output, which type of mismatch is the problem?

The correct answer is B. peer identity. Peer identity (ID) is the value each VPN endpoint uses to identify itself to the other side during IKE authentication - it can be an IP address, FQDN, email address, or DN (distinguished name). A peer identity mismatch occurs when what one router sends as its identity does not…

Troubleshooting Using ASDM and CLI

Question

Refer to the exhibit. Which type of site-to-site VPN tunnel between two routers is down. Based on the debug output, which type of mismatch is the problem?

Exhibit

Options

Apreshared key
Bpeer identity
Ctransform set
Dikev2 proposal

How the community answered

(35 responses)

A
6% (2)
B
57% (20)
C
14% (5)
D
23% (8)

Explanation

Peer identity (ID) is the value each VPN endpoint uses to identify itself to the other side during IKE authentication - it can be an IP address, FQDN, email address, or DN (distinguished name). A peer identity mismatch occurs when what one router sends as its identity does not match what the other router expects (configured via 'identity' or 'match identity' commands). In the debug output, this typically appears as 'ID validation failed' or 'Peer ID does not match' after Phase 1 encryption is established but before authentication completes. A preshared key mismatch (A) would show as a HASH payload authentication failure. A transform set mismatch (C) fails during Phase 2 proposal exchange. An IKEv2 proposal mismatch (D) would fail during Phase 1 SA negotiation with a 'no proposal chosen' message.

Topics

#site-to-site VPN#peer identity#IKEv2#debug output

Community Discussion

No community discussion yet for this question.

Full 300-730 Practice