When an on-premises NGFW (customer gateway) is used to connect to the Virtual Gateway, which two IKE profiles cannot be used? (Choose two.)

Question

Options

• AGroup2 / SHA-1 / AES-128-CBC / IKE-V1
• BGroup2 / SHA-1 / AES-128-GCM / IKE-V1
• CGroup14 / SHA-256 / AES-256-GCM / IKE-V1
• DGroup2 / SHA-1 / AES-128-CBC
• EGroup14 / SHA-256 / AES-256-CBC / IKE-V1

• A
  4% (2)
• B
  15% (7)
• C
  73% (35)
• D
  8% (4)

Explanation

Options C and E are invalid because both pair IKEv1 with the stronger parameter set (Group14 / SHA-256 / AES-256), which the Virtual Gateway does not support over IKEv1 - those higher-security parameters are only permitted with IKEv2. Option C has a second strike as well: AES-GCM is an AEAD (Authenticated Encryption with Associated Data) cipher that is architecturally incompatible with IKEv1, which requires separate encryption and integrity algorithms; GCM inherently demands IKEv2.

Options A and B are valid because they use the IKEv1-compatible weaker profile (Group2 / SHA-1 / AES-128), and option D is valid because it specifies Group2/SHA-1/AES-128-CBC without locking to a specific IKE version, making it usable by either.

Memory tip: Think "Group14 = Gate to IKEv2" - once you step up to Group14/SHA-256/AES-256 strength, you must walk through the IKEv2 gate. And for GCM specifically: "GCM needs V2 to gleam" - AES-GCM's combined auth/encrypt design only works in IKEv2.

No community discussion yet for this question.