You are testing the use of the automated port-access role configuration process using RadSec authentication over VXLAN. During your testing, you observed that the RadSec connection will fail during…

Question

Options

• AThe ENCRYPT-TYPE was configured as AES with a hex-string of 64 hexadecimal digits that was
• BThe RadSec server was defined on the switch using an IPv6 address that was unreachable
• CThe RadSec TCP packets are being dropped, and the TLS tunnel is not established
• DTracking mode was set to 'dead-only', and the RadSec server was marked as unreachable

• A
  18% (6)
• B
  27% (9)
• C
  45% (15)
• D
  9% (3)

Explanation

Option C is correct because RadSec relies on TLS to create a secure tunnel, and the digital certificate exchange is part of the TLS handshake. If TCP packets are being dropped (as can happen across a VXLAN overlay due to MTU issues, ACLs, or encapsulation overhead), the TLS session never completes - meaning the certificate exchange never occurs, which is exactly the symptom described.

Why the distractors are wrong:

• A describes an AES encryption key configuration issue (64 hex digits = valid AES-256 key), which is unrelated to the certificate exchange process during TLS negotiation.
• B would cause a complete connection failure before any certificate exchange begins - you'd never reach the TLS handshake stage if the server IP is unreachable.
• D similarly prevents connection attempts entirely; a server marked unreachable in dead-only tracking mode means the switch skips it altogether, so no TLS handshake is even initiated.

Memory tip: Think of RadSec as "RADIUS in a TLS envelope." The certificate exchange is the envelope-sealing step - if TCP (the delivery truck) is dropping packets, the envelope never gets sealed. No TLS tunnel = no cert exchange, regardless of what's inside.

No community discussion yet for this question.