The connection between Site_1 and Site_2 is as shown in the figure. According to the configuration analysis in the figure, when sending a data packet from Site_2 to Site_1, the source IP address in…

Question

Options

• A10.0.0.2
• B
• C
• D

• A
  78% (21)
• B
  11% (3)
• C
  4% (1)
• D
  7% (2)

Explanation

Option A (10.0.0.2) is correct because the payload IP header refers to the inner (original) IP header preserved inside the IPsec tunnel encapsulation - and since the packet originates from Site_2, its original source address (10.0.0.2) is carried unchanged inside the encapsulated payload, even as a new outer IP header wraps it with the tunnel endpoints' addresses.

In IPsec tunnel mode (which IKE negotiates), two IP headers exist: the outer header carries the VPN gateway addresses (used for routing across the public network), while the inner/payload header retains the original private-network source and destination IPs. The question specifically asks about the payload header, making the original Site_2 host address (10.0.0.2) the only valid answer.

The distractors likely included the public IP of Site_2's gateway or Site_1's IP addresses - those would appear in the outer header or destination fields, respectively, not as the payload source IP.

Memory tip: Think "payload = preserved original." Whatever IP the sending host had before the tunnel grabbed the packet is what lives in the payload/inner header - the tunnel only adds a new outer wrapper; it doesn't overwrite the original source.

No community discussion yet for this question.