If the IPSec security protocols supported by both peers are inconsistent, which of the following consequences will result?

Question

Options

• APoor IPSec service quality
• BIPSec SA cannot be established
• CIKE SA cannot be established
• DNo data flow triggers IKE negotiation

• A
  13% (4)
• B
  77% (24)
• C
  6% (2)
• D
  3% (1)

Explanation

IPSec negotiation happens in two phases: Phase 1 establishes the IKE SA (a secure channel for negotiation), and Phase 2 uses that channel to establish the IPSec SA (the actual data-protection tunnel). The IPSec security protocol (AH vs. ESP) is negotiated in Phase 2 - if the two peers can't agree on a common protocol, Phase 2 fails and the IPSec SA cannot be established (B), meaning no protected data tunnel ever forms.

Why the distractors are wrong:

• A (poor service quality) - Incompatibility is a binary failure, not a degradation. There's no tunnel at all, not a slow one.
• C (IKE SA cannot be established) - IKE SA (Phase 1) negotiates IKE-specific parameters (DH group, encryption for the negotiation channel, authentication method) - not the IPSec protocol itself. Phase 1 can succeed even when IPSec protocols are mismatched.
• D (no data flow triggers IKE negotiation) - Traffic still triggers IKE negotiation normally; the problem is that the Phase 2 negotiation fails, not that it never starts.

Memory tip: Picture a two-floor building - the IKE SA is the ground floor (built first, independent of upstairs), and the IPSec SA is the second floor. A disagreement about IPSec protocols collapses the second floor only, leaving the ground floor standing - so IKE SA survives but IPSec SA cannot be built on top of it.

No community discussion yet for this question.