300-730 · Question #99
In order to enable FlexVPN to use a AAA attribute list, which two tasks must be performed? (Choose two.)
The correct answer is B. Verify that clients are using the correct authorization policy.. For FlexVPN to use an AAA attribute list, clients must be confirmed to reference the correct authorization policy that invokes the attribute list.
Question
Options
- ADefine the RADIUS server.
- BVerify that clients are using the correct authorization policy.
- CDefine the AAA server.
- DAssign the list to an authorization policy.
- ESet the maximum segment size.
How the community answered
(45 responses)- A2% (1)
- B84% (38)
- C9% (4)
- D4% (2)
Why each option
For FlexVPN to use an AAA attribute list, clients must be confirmed to reference the correct authorization policy that invokes the attribute list.
Defining a RADIUS server is a general AAA prerequisite but does not specifically bind a FlexVPN authorization policy to an attribute list.
FlexVPN leverages IKEv2 authorization policies to apply AAA-derived attributes such as IP address pools and ACLs to connecting clients. Verifying that clients are bound to the correct authorization policy ensures the configured AAA attribute list is actually invoked during IKEv2 authentication, without which the attribute list is defined but never applied.
Defining an AAA server establishes reachability to the authentication service but alone does not configure FlexVPN to use an attribute list.
Assigning the list to an authorization policy is a related configuration step, but without confirming clients reference the correct policy, the assignment has no effect.
Setting the maximum segment size is a TCP optimization and is entirely unrelated to AAA attribute list configuration in FlexVPN.
Concept tested: FlexVPN IKEv2 AAA attribute list authorization policy binding
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/xe-3s/sec-flex-vpn-xe-3s-book/sec-cfg-flex-vpn.html
Topics
Community Discussion
No community discussion yet for this question.