nerdexam
Cisco

300-730 · Question #92

Refer to the exhibit. A user is connecting from behind a PC with a private IP Address. Their ISP provider is blocking TCP port 443. Which AnyConnect XML configuration will allow the user to…

The correct answer is B. <HostEntry><HostName>RAVPN</HostName><HostAddress>209.165.202.225</HostAddress><PrimaryProtocol>IPsec</PrimaryProtocol><StandardAuthenticationOnly>false</StandardAuthenticationOnly></PrimaryProtocol></HostEntry>. Because the ISP blocks TCP 443 used by SSL/TLS AnyConnect, the XML profile must explicitly specify IPsec as the primary protocol and reference the correct ASA outside IP address.

Remote Access VPN

Question

Refer to the exhibit. A user is connecting from behind a PC with a private IP Address. Their ISP provider is blocking TCP port 443. Which AnyConnect XML configuration will allow the user to establish a connection with the ASA?

Options

  • A<HostEntry><HostName>RAVPN</HostName><HostAddress>209.165.202.129</HostAddress><PrimaryProtocol>IPsec</PrimaryProtocol><StandardAuthenticationOnly>false</StandardAuthenticationOnly></PrimaryProtocol></HostEntry>
  • B<HostEntry><HostName>RAVPN</HostName><HostAddress>209.165.202.225</HostAddress><PrimaryProtocol>IPsec</PrimaryProtocol><StandardAuthenticationOnly>false</StandardAuthenticationOnly></PrimaryProtocol></HostEntry>
  • C<HostEntry><HostName>RAVPN</HostName><HostAddress>209.165.202.129</HostAddress></HostEntry>
  • D<HostEntry><HostName>RAVPN</HostName><HostAddress>209.165.202.225</HostAddress></HostEntry>

How the community answered

(41 responses)
  • A
    2% (1)
  • B
    71% (29)
  • C
    17% (7)
  • D
    10% (4)

Why each option

Because the ISP blocks TCP 443 used by SSL/TLS AnyConnect, the XML profile must explicitly specify IPsec as the primary protocol and reference the correct ASA outside IP address.

A<HostEntry><HostName>RAVPN</HostName><HostAddress>209.165.202.129</HostAddress><PrimaryProtocol>IPsec</PrimaryProtocol><StandardAuthenticationOnly>false</StandardAuthenticationOnly></PrimaryProtocol></HostEntry>

Although the IPsec protocol is correctly specified, 209.165.202.129 is not the outside interface address of the ASA shown in the exhibit, so the client would fail to reach the correct headend.

B<HostEntry><HostName>RAVPN</HostName><HostAddress>209.165.202.225</HostAddress><PrimaryProtocol>IPsec</PrimaryProtocol><StandardAuthenticationOnly>false</StandardAuthenticationOnly></PrimaryProtocol></HostEntry>Correct

IPsec with IKEv2 uses UDP ports 500 and 4500, which are not blocked by the ISP's TCP 443 filter, allowing the tunnel to be established successfully. The address 209.165.202.225 corresponds to the correct outside interface of the ASA as shown in the exhibit, ensuring the client targets the right headend with the right protocol.

C<HostEntry><HostName>RAVPN</HostName><HostAddress>209.165.202.129</HostAddress></HostEntry>

This entry omits the PrimaryProtocol element, causing AnyConnect to default to SSL/TLS on TCP 443 which the ISP blocks, and it also references the wrong IP address.

D<HostEntry><HostName>RAVPN</HostName><HostAddress>209.165.202.225</HostAddress></HostEntry>

This entry also omits the PrimaryProtocol element and defaults to SSL/TLS on TCP 443, which the ISP is blocking, preventing the VPN connection from being established.

Concept tested: AnyConnect XML IPsec protocol selection to bypass SSL port block

Source: https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect49/administration/guide/b_AnyConnect_Administrator_Guide_4-9.html

Topics

#AnyConnect#IPsec#XML profile#port 443 blocked

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-730 Practice