PCNSE · Question #774
A firewall administrator is configuring an IPSec tunnel between Site A and Site B. The Site A firewall uses a DHCP assigned address on the outside interface of the firewall, and the Site B firewall…
The correct answer is A. Match IKE version on both firewalls. D. Disable passive mode on Site A firewall. To resolve dynamic peering issues for an IPSec tunnel, ensure both firewalls use the same IKE version and the dynamic IP peer is configured to initiate the tunnel.
Question
A firewall administrator is configuring an IPSec tunnel between Site A and Site B. The Site A firewall uses a DHCP assigned address on the outside interface of the firewall, and the Site B firewall uses a static IP address assigned to the outside interface of the firewall. However, the use of dynamic peering is not working. Refer to the two sets of configuration settings provided. Which two changes will allow the configurations to work? (Choose two.) Site A configuration:
Site B configuration:
Exhibits
Options
- AMatch IKE version on both firewalls.
- BConfigure Local Identification on Site B firewall.
- CEnable NAT Traversal on Site B firewall.
- DDisable passive mode on Site A firewall.
How the community answered
(26 responses)- A73% (19)
- B15% (4)
- C12% (3)
Why each option
To resolve dynamic peering issues for an IPSec tunnel, ensure both firewalls use the same IKE version and the dynamic IP peer is configured to initiate the tunnel.
For IKE negotiation to successfully establish an IPSec tunnel, both VPN peers must be configured to use the identical IKE version (either IKEv1 or IKEv2); a mismatch will prevent tunnel establishment.
Local Identification is configured on both peers, but Site B having a static IP suggests its local ID would be its static address, and its absence isn't the primary reason dynamic peering fails, especially when IKE versions and initiation modes are more critical.
NAT Traversal (NAT-T) is necessary only if either VPN peer is behind a NAT device, which is not explicitly stated or implied as the cause of dynamic peering failure in this scenario.
When one firewall (Site A) has a dynamic IP address and dynamic peering is desired, it must be the active initiator of the VPN connection. Disabling passive mode on Site A ensures it attempts to establish the IKE negotiation.
Concept tested: IPSec dynamic peering configuration and troubleshooting
Source: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/vpns/set-up-an-ipsec-vpn-tunnel/configure-ike-gateway-for-a-dynamic-ip-address.html
Topics
Community Discussion
No community discussion yet for this question.