An administrator reviews the following log and determines the root cause of a site-to-site tunnel failure: Which of the following actions should the administrator take to most effectively correct…

The correct answer is C. Add a new subnet as a permitted initiator. The IKE log is explicitly failing at Quick Mode with “no matching selector config,” even though the crypto proposals line up perfectly. That means the tunnel’s traffic-selector (the local/remote subnets) doesn’t match the policy on one side. In this case the peer is offering…

Submitted by the_admin· Mar 6, 2026Security Engineering

Question

An administrator reviews the following log and determines the root cause of a site-to-site tunnel failure:

Which of the following actions should the administrator take to most effectively correct the failure?

Exhibits

Options

AEnable perfect forward secrecy on the remote peer.
BUpdate the cipher suites configured for use on the server side.
CAdd a new subnet as a permitted initiator.
DDisable IKE version 1 and run IKE version 2.

How the community answered

(26 responses)

A
8% (2)
B
19% (5)
C
69% (18)
D
4% (1)

Explanation

The IKE log is explicitly failing at Quick Mode with “no matching selector config,” even though the crypto proposals line up perfectly. That means the tunnel’s traffic-selector (the local/remote subnets) doesn’t match the policy on one side. In this case the peer is offering 8.19.99.1/24 (and expecting 8.18.99.1/24 on our side), but our IPSec policy likely only permits, for example, 8.19.99.0/24 ↔ 8.18.99.0/24. By adding the actual /24 network (e.g. 8.19.99.0/24) or the specific /24 selector that the peer is initiating as a permitted initiator, the Quick Mode selectors will align and the tunnel will establish.

Community Discussion

No community discussion yet for this question.

Full CAS-005 Practice