Refer to the exhibit. The VPN concentrator is experiencing issues. Which action should be taken to ensure a stable environment?

Question

Exhibit

Options

• AAdd a deny any/any firewall rule to the end of the firewall rules.
• BRemove the connection from Internet 1.
• CPhysically disconnect all LAN ports.
• DConfigure the MX appliance to Routed mode on the Addressing & VLANS page.

• A
  3% (2)
• B
  10% (6)
• C
  81% (47)
• D
  5% (3)

Explanation

Physically disconnecting all LAN ports removes the source of instability when an MX appliance is operating as a VPN concentrator - in this mode, the device is designed to aggregate VPN tunnels between sites, not to serve local LAN clients, so active LAN connections create routing loops or spanning tree conflicts that destabilize the environment.

Why the distractors are wrong:

• A - A trailing deny any/any rule is a firewall best practice, but it addresses security policy, not VPN concentrator instability.
• B - Removing Internet 1 eliminates a WAN uplink, which would break VPN tunnel connectivity rather than stabilize it.
• D - Routed mode would convert the MX into a gateway/NAT device, fundamentally changing its role away from acting as a pure VPN concentrator; the concentrator function requires Passthrough mode, not Routed mode.

Memory tip: Think of a VPN concentrator as a "tunnel hub" - it only needs WAN connections to aggregate tunnels. LAN ports belong to a router, not a concentrator. If the concentrator has LAN ports plugged in, you've mixed roles → disconnect them to restore stability.

No community discussion yet for this question.