300-730 · Question #83
Refer to the exhibit. Upon setting up a tunnel between two sites, users are complaining that connections to applications over the VPN are not working consistently. The output of show crypto ipsec sa…
The correct answer is D. Make an adjustment to IPsec replay window. The mismatch between pkts encaps (26773) and pkts encrypt (16228) shows roughly 10,500 packets were dropped before encryption, which is a hallmark symptom of the IPsec anti-replay window being too small.
Question
Options
- ALower the tunnel MTU.
- BEnable perfect forward secrecy.
- CSpecify the application networks in the remote identity.
- DMake an adjustment to IPsec replay window.
How the community answered
(23 responses)- A4% (1)
- B22% (5)
- C9% (2)
- D65% (15)
Why each option
The mismatch between pkts encaps (26773) and pkts encrypt (16228) shows roughly 10,500 packets were dropped before encryption, which is a hallmark symptom of the IPsec anti-replay window being too small.
Lowering the tunnel MTU addresses fragmentation-related issues, not the packet count discrepancy between encapsulation and encryption counters seen in this output.
Enabling Perfect Forward Secrecy improves key exchange security by generating unique session keys but has no effect on packet drops caused by sequence number window violations.
Specifying application networks in the remote identity refines the interesting traffic selector, which would affect which flows are protected, not the per-packet drop behavior reflected in mismatched encaps versus encrypt counters.
The counter discrepancy between pkts encaps (26773) and pkts encrypt (16228) indicates that a large number of packets were accepted for processing but then silently dropped before encryption, which is consistent with the IPsec anti-replay mechanism rejecting packets whose sequence numbers fall outside the accepted window. This commonly occurs when traffic is reordered in transit or when the window size is too small for high-throughput or asymmetrically routed links. Increasing the IPsec replay window size with the crypto ipsec security-association replay window-size command allows the device to tolerate a wider sequence number range and resolves the inconsistent connectivity.
Concept tested: IPsec anti-replay window packet drop diagnosis
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnips/configuration/xe-16/sec-vpn-ipsec-xe-16-book/sec-cfg-vpn-ipsec.html
Topics
Community Discussion
No community discussion yet for this question.