nerdexam
Cisco

300-730 · Question #81

An engineer would like Cisco AnyConnect users to be able to reach servers within the 10.10.0.0/16 subnet while all other traffic is sent out to the Internet. Which IPsec configuration accomplishes…

The correct answer is B. crypto ikev2 authorization policy Local_Authz_01 route set access-list Secured_Routes ip access-list extended Secured_Routes permit ip any 10.10.0.0 0.0.255.255. Split-tunnel routing for IKEv2 AnyConnect requires an authorization policy using 'route set access-list' with an extended ACL that identifies the subnets to tunnel, allowing all other traffic to exit locally.

Remote Access VPN

Question

An engineer would like Cisco AnyConnect users to be able to reach servers within the 10.10.0.0/16 subnet while all other traffic is sent out to the Internet. Which IPsec configuration accomplishes this task?

Options

  • Acrypto ikev2 authorization policy Local_Authz_01 route set local ipv4 10.10.0.0 0.0.255.255
  • Bcrypto ikev2 authorization policy Local_Authz_01 route set access-list Secured_Routes ip access-list extended Secured_Routes permit ip any 10.10.0.0 0.0.255.255
  • Ccrypto ikev1 authorization policy Local_Authz_01 route set access-list Secured_Routes ip access-list extended Secured_Routes permit ip any 10.10.0.0 0.0.255.255
  • Dcrypto ikev2 authorization policy Local_Authz_01 route set remote ipv4 10.10.0.0 0.0.255.255

How the community answered

(46 responses)
  • A
    9% (4)
  • B
    85% (39)
  • C
    2% (1)
  • D
    4% (2)

Why each option

Split-tunnel routing for IKEv2 AnyConnect requires an authorization policy using 'route set access-list' with an extended ACL that identifies the subnets to tunnel, allowing all other traffic to exit locally.

Acrypto ikev2 authorization policy Local_Authz_01 route set local ipv4 10.10.0.0 0.0.255.255

'route set local ipv4' defines locally reachable addresses from the ASA's perspective rather than pushing split-tunnel routes to the client, so it does not control what traffic the client tunnels.

Bcrypto ikev2 authorization policy Local_Authz_01 route set access-list Secured_Routes ip access-list extended Secured_Routes permit ip any 10.10.0.0 0.0.255.255Correct

The IKEv2 authorization policy 'route set access-list Secured_Routes' instructs the ASA to push only the ACL-defined routes into the client's tunnel, implementing split tunneling. The extended ACL 'permit ip any 10.10.0.0 0.0.255.255' correctly identifies all traffic destined for 10.10.0.0/16 to be tunneled, while all other traffic is sent directly to the Internet. Using IKEv2 is required for AnyConnect IPsec (IKEv2-based) deployments.

Ccrypto ikev1 authorization policy Local_Authz_01 route set access-list Secured_Routes ip access-list extended Secured_Routes permit ip any 10.10.0.0 0.0.255.255

IKEv1 is not supported for Cisco AnyConnect IPsec deployments - AnyConnect IPsec requires IKEv2, making this configuration invalid for the stated requirement.

Dcrypto ikev2 authorization policy Local_Authz_01 route set remote ipv4 10.10.0.0 0.0.255.255

'route set remote ipv4' can push a single static route but the syntax requires a standard subnet mask (e.g., 255.255.0.0), not a wildcard mask (0.0.255.255), making this command malformed and non-functional.

Concept tested: IKEv2 authorization policy split-tunnel route injection

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ikevpn/configuration/xe-16/sec-ike-v2-flex-xe-16-book/sec-cfg-ikev2-flex.html

Topics

#IKEv2 authorization policy#split tunneling#route set#AnyConnect

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-730 Practice