nerdexam
Cisco

300-730 · Question #83

Refer to the exhibit. Upon setting up a tunnel between two sites, users are complaining that connections to applications over the VPN are not working consistently. The output of show crypto ipsec sa…

The correct answer is D. Make an adjustment to IPsec replay window. The mismatch between pkts encaps (26773) and pkts encrypt (16228) shows roughly 10,500 packets were dropped before encryption, which is a hallmark symptom of the IPsec anti-replay window being too small.

Troubleshooting VPNs

Question

Refer to the exhibit. Upon setting up a tunnel between two sites, users are complaining that connections to applications over the VPN are not working consistently. The output of show crypto ipsec sa was collected on one of the VPN devices. Based on this output, what should be done to fix this issue? interface: Tunnel10 #crypto esp sa: Tunnel10-head-0, local addr 10.10.10.1 protected vrf: (none) local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0) remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0) current spi: 0x16810.1 port 500 PERMIT, flags=(origin_is_acl,) #pkts encaps: 26773, #pkts encrypt: 16228, #pkts digest: 16228 #pkts decaps: 26773, #pkts decrypt: 26773, #pkts verify: 26773 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts not decompressed: 0 #pkts not decapsulated: 0, #pkts decompressed failed: 0 #pkts no sa (send): 0, #pkts invalid sa (rcv): 0 #pkts encrypted failed (send): 0, #pkts decrypted failed (rcv): 0 #pkts invalid inpt (rcv): 0, #pkts verify failed: 0 #pkts invalid identify (rcv): 0, #pkts invalid req (rcv): 0 #pkts replay rollover (send): 0, #pkts replay rollover (rcv): 0 #pkts replay failed (rcv): 2375 #pkts tagged (send): 0, #pkts untagged (rcv): 0 #pkts not tagged (send): 0, #pkts not untagged (rcv): 0 #pkts internal err (rcv): 0, #pkts internal err (rcv): 0 local crypto endpt.: 1.10.10.0, remote crypto endpt.: 192.168.0.1 plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu lab GigabitEthernet0/0/0 current outbound spi: 0x48998999 (1218021785) PFS (Y/N): N, DH group: none

Options

  • ALower the tunnel MTU.
  • BEnable perfect forward secrecy.
  • CSpecify the application networks in the remote identity.
  • DMake an adjustment to IPsec replay window.

How the community answered

(23 responses)
  • A
    4% (1)
  • B
    22% (5)
  • C
    9% (2)
  • D
    65% (15)

Why each option

The mismatch between pkts encaps (26773) and pkts encrypt (16228) shows roughly 10,500 packets were dropped before encryption, which is a hallmark symptom of the IPsec anti-replay window being too small.

ALower the tunnel MTU.

Lowering the tunnel MTU addresses fragmentation-related issues, not the packet count discrepancy between encapsulation and encryption counters seen in this output.

BEnable perfect forward secrecy.

Enabling Perfect Forward Secrecy improves key exchange security by generating unique session keys but has no effect on packet drops caused by sequence number window violations.

CSpecify the application networks in the remote identity.

Specifying application networks in the remote identity refines the interesting traffic selector, which would affect which flows are protected, not the per-packet drop behavior reflected in mismatched encaps versus encrypt counters.

DMake an adjustment to IPsec replay window.Correct

The counter discrepancy between pkts encaps (26773) and pkts encrypt (16228) indicates that a large number of packets were accepted for processing but then silently dropped before encryption, which is consistent with the IPsec anti-replay mechanism rejecting packets whose sequence numbers fall outside the accepted window. This commonly occurs when traffic is reordered in transit or when the window size is too small for high-throughput or asymmetrically routed links. Increasing the IPsec replay window size with the crypto ipsec security-association replay window-size command allows the device to tolerate a wider sequence number range and resolves the inconsistent connectivity.

Concept tested: IPsec anti-replay window packet drop diagnosis

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnips/configuration/xe-16/sec-vpn-ipsec-xe-16-book/sec-cfg-vpn-ipsec.html

Topics

#IPsec SA#replay window#show crypto ipsec sa#troubleshooting

Community Discussion

No community discussion yet for this question.

Full 300-730 Practice