In IPSec networking, which of the following scenarios are policy templates suitable for? (Multiple choice)

Question

Options

• APoint-to-multipoint, in which the headquarters exit address is fixed and the branch exit address is
• BPoint-to-multipoint, the headquarters exit address and the branch exit address are not fixed.
• CPoint-to-point, the addresses of both parties are not fixed.
• DPoint-to-point, one party's IP address is not fixed

• A
  84% (26)
• B
  10% (3)
• C
  6% (2)

Explanation

IPSec Policy Templates are designed for scenarios where one endpoint has a fixed IP address (acting as the responder/server) and accepts connections from peers with dynamic/unknown IP addresses (initiators). This makes A and D correct:

• A fits because in a hub-and-spoke topology, HQ holds a fixed address and uses a policy template to accept incoming connections from any branch - regardless of the branch's changing IP.
• D fits because even in a simple point-to-point tunnel, a policy template works as long as one side is fixed (the responder) and the other is dynamic (the initiator).

B is wrong because if HQ's address is also unfixed, branches have no stable destination to initiate connections to - the template mechanism breaks down entirely, since the responder itself is unreachable at a consistent address. C is wrong for the same reason in a P2P context: if both parties have dynamic addresses, neither can reliably initiate a connection to the other, and a template alone cannot solve this mutual unpredictability.

Memory tip: Think of a policy template as a hotel front desk - it only works if the hotel (responder) has a fixed, known address where guests (dynamic-IP initiators) can show up. If the hotel itself keeps moving, no guest can find it.

No community discussion yet for this question.