Refer to the exhibit. Which type of mismatch is causing the problem with the IPsec VPN tunnel?

The correct answer is D. preshared key. A preshared key (PSK) mismatch causes IKE Phase 1 authentication to fail. In IKEv1 Main Mode, both peers derive a SKEYID from the preshared key and use it to create a HASH payload that proves knowledge of the shared secret. If the keys differ, the HASH values will not match and…

Troubleshooting VPNs

Question

Refer to the exhibit. Which type of mismatch is causing the problem with the IPsec VPN tunnel?

Options

Acrypto access list
BPhase 1 policy
Ctransform set
Dpreshared key

How the community answered

(36 responses)

A
3% (1)
B
3% (1)
C
8% (3)
D
86% (31)

Explanation

A preshared key (PSK) mismatch causes IKE Phase 1 authentication to fail. In IKEv1 Main Mode, both peers derive a SKEYID from the preshared key and use it to create a HASH payload that proves knowledge of the shared secret. If the keys differ, the HASH values will not match and the peer will reject authentication - the debug typically shows 'ISAKMP: hash verification failed' or 'Authentication failed' during Phase 1. A crypto ACL mismatch (A) would allow Phase 1 to succeed but fail Phase 2 on proxy ID negotiation. A Phase 1 policy mismatch (B) would show 'no proposal chosen' before authentication even begins, as encryption and hash algorithms are negotiated first. A transform set mismatch (C) would fail Phase 2 SA negotiation after Phase 1 completes successfully.

Topics

#IPsec troubleshooting#preshared key mismatch#IKE Phase 1#VPN debug

Community Discussion

No community discussion yet for this question.

Full 300-730 Practice