You are troubleshooting a new IPsec VPN that is configured between your corporate office and the RemoteSite1 SRX Series device. The VPN is not currently establishing. The RemoteSite1 device is being…

Question

Exhibit

Options

• AOn the RemoteSite1 device, change the IKE gateway external interface to st0.0.
• BOn both devices, change the IKE version to use version 2 only.
• COn both devices, change the IKE policy proposal set to basic.
• DOn both devices, change the IKE policy mode to aggressive.

• A
  4% (1)
• B
  4% (1)
• C
  8% (2)
• D
  84% (21)

Explanation

Aggressive mode is required when an IP address is dynamically assigned, such as through DHCP, as it allows for faster establishment with less identity verification. The configuration shown in the exhibit highlights that the RemoteSite1 SRX Series device is using DHCP to obtain an IP address for its external interface (ge-0/0/2). This introduces a challenge in IPsec VPN configurations when the public IP address of the remote site is not static, as is the case here. Aggressive mode in IKE (Internet Key Exchange) is designed for situations where one or both peers have dynamically assigned IP addresses. In this scenario, aggressive mode allows the devices to exchange identifying information, such as hostnames, rather than relying on static IP addresses, which is necessary when the remote peer (RemoteSite1) has a dynamic IP from DHCP. Correct Action (D): Changing the IKE policy mode to aggressive will resolve the issue by allowing the two devices to establish the VPN even though one of them is using DHCP. In aggressive mode, the initiator can present its identity (hostname) during the initial handshake, enabling the VPN to be established successfully.

No community discussion yet for this question.