Which of the following descriptions about using ACLs as IPSec interesting flow matching rules are correct? (Multiple choice)

Question

Options

• AACLs configured in the same IPSec security policy group can contain the same rules.
• BIf different data flows have different security requirements, different ACLs and corresponding
• CIf the interface to which the IPSec security policy is applied is also configured with NAT, IPSec will
• DThe protocol types defined by ACL rules at both ends of the IPSec tunnel must be consistent. For

• A
  17% (6)
• B
  83% (30)

Explanation

B, C, and D are correct because they reflect real-world IPSec ACL behavior: different traffic flows with distinct security requirements must use separate ACLs paired with separate security policies (B); when NAT and IPSec coexist on the same interface, interesting traffic must be exempt from NAT (typically via a NAT exemption rule) so IPSec can match it before NAT translates the addresses (C); and the ACL rules on both tunnel endpoints must be mirror images of each other - same protocol, with source and destination swapped - so both peers agree on what traffic to protect (D).

A is wrong because ACLs within the same IPSec security policy group must have unique, non-overlapping rules. Duplicate rules create ambiguity in traffic matching and are not permitted - each ACL must identify a distinct traffic flow.

Memory tip: Think "IPSec ACLs need a handshake" - both sides must match (D), different needs get different policies (B), and NAT must step aside for IPSec (C). The trap answer (A) breaks the rule that every ACL in a policy group must be unique, just like no two rules in a routing table can be identical.

No community discussion yet for this question.