nerdexam
Cisco

300-730 · Question #88

While troubleshooting, an engineer finds that the show crypto isakmp sa command indicates that the last state of the tunnel is MM_KEY_EXCH. What is the next step that should be taken to resolve this…

The correct answer is D. Confirm that the pre-shared keys match on both devices. The MM_KEY_EXCH state in IKEv1 Main Mode indicates SA proposals and Diffie-Hellman exchange already succeeded, so the failure is at the authentication step - most commonly caused by mismatched pre-shared keys.

Troubleshooting VPNs

Question

While troubleshooting, an engineer finds that the show crypto isakmp sa command indicates that the last state of the tunnel is MM_KEY_EXCH. What is the next step that should be taken to resolve this issue?

Options

  • AVerify that the ISAKMP proposals match.
  • BEnsure that UDP 500 is not being blocked between the devices.
  • CCorrect the peer's IP address on the crypto map.
  • DConfirm that the pre-shared keys match on both devices.

How the community answered

(30 responses)
  • A
    13% (4)
  • B
    10% (3)
  • C
    3% (1)
  • D
    73% (22)

Why each option

The MM_KEY_EXCH state in IKEv1 Main Mode indicates SA proposals and Diffie-Hellman exchange already succeeded, so the failure is at the authentication step - most commonly caused by mismatched pre-shared keys.

AVerify that the ISAKMP proposals match.

Mismatched ISAKMP proposals cause failure at the MM_SA_SETUP state, not MM_KEY_EXCH, because proposal negotiation occurs before the Diffie-Hellman exchange.

BEnsure that UDP 500 is not being blocked between the devices.

If UDP 500 were blocked between devices, no IKE packets would be exchanged and the SA would remain in MM_NO_STATE, never progressing to MM_KEY_EXCH.

CCorrect the peer's IP address on the crypto map.

An incorrect peer IP address would prevent IKE initiation entirely, so the SA would not progress to MM_KEY_EXCH.

DConfirm that the pre-shared keys match on both devices.Correct

In IKEv1 Main Mode, MM_KEY_EXCH indicates that Phase 1 negotiations progressed through SA proposal agreement and Diffie-Hellman key exchange but stalled at peer authentication. Because the tunnel already reached this state, both ISAKMP proposals matched and UDP 500 is confirmed open. Mismatched pre-shared keys prevent successful SKEYID-based authentication, causing the Phase 1 SA to fail at exactly this stage.

Concept tested: IKEv1 Main Mode state machine troubleshooting

Source: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409-ipsec-debug-00.html

Topics

#IKEv1#ISAKMP#MM_KEY_EXCH#pre-shared key

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-730 Practice