Exam 300-710 topic 1 question 276 discussion

Actual exam question from Cisco's 300-710

Question #: 276
Topic #: 1

Remote users who connect via Cisco Secure Client to the corporate network behind a Cisco Secure Firewall Threat Defense device are reporting no audio on calls when calling between remote users using their softphones. These same users can call internal users on the corporate network without any issues. What is the cause of this issue?

A. The hairpinning feature is not available on Cisco Secure Firewall Threat Defense
B. Cisco Secure Firewall Threat Defense needs a NAT policy that allows outside to outside communication
C. The Enable Spoke to Spoke Connectivity through Hub option is not selected on Cisco Secure Firewall Threat Defense
D. Split tunneling is enabled for the Remote Access VPN on Cisco Secure Firewall Threat Defense

Show Suggested Answer

Suggested Answer: B 🗳️

by Bubu3k at Jan. 13, 2024, 12:13 p.m.

Comments

Submit Cancel

Bubu3k

Highly Voted 11 months, 2 weeks ago

Selected Answer: B

Based on the following scenarios I'd be leaning more on B: -No audio on the call between an AnyConnect Client and an external number. -No audio on the call between an AnyConnect Client and another AnyConnect Client. https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client-v4x/220337-troubleshoot-common-anyconnect-communica.html

upvoted 7 times

d0980cc

2 months, 2 weeks ago

Bubu3k great find. Here's the one that pertains to FTD. https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/216180-troubleshoot-common-anyconnect-communica.html#anc8:~:text=check%20that%20the%20correct%20inbound%20and%20outbound%20interfaces%20configuration%20is%20in%20place

upvoted 1 times

...

Silexis

Most Recent 4 months, 2 weeks ago

Selected Answer: A

Option B is wrong. When a VPN Client calls another VPN Client, there will be a P2P communication, so the first thing which is passing through my mind in HairPin or Spoke-to-Spoke communication. This means that traffic entering through the tunnel interface from one client, it will return to the same interface when calling the other client (an U-turn or hairpin). So, the command: same-security-traffic permit intra-interface .......is missing. This is why I will stick with A

upvoted 1 times

Silexis

4 months, 2 weeks ago

I can't delete this. In case of a Full Tunnel there is a Hairpin when calling between VPN clients but the answer says "it is not available" which is false. I have changed the answer to D - sorry for this

upvoted 1 times

...

Silexis

4 months, 2 weeks ago

Though, the wording "is not available" it might be wrong. (hate Cisco for such a bad wording) It might also be D where there is an Extended ACL for split tunneling and there are missing subnets - rendering host from subnet A cannot call host from subnet B. A full tunnel gateway wont suffer from this thing and only the Spoke-to-Spoke command has to be taken care of (I am running such a deployment on FTD and RAVPN and I don't have any NAT configured but the U-turn and indeed in full-tunnel mode and the Cisco Jabber calls are working just fine)

upvoted 1 times

...

ricckku

9 months ago

A is the correct answer. The hair-pinning feature is definitely required. https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215875-configure-anyconnect-vpn-client-on-ftd.html#toc-hId-1618727688

upvoted 2 times

...

aaInman

10 months, 2 weeks ago

Selected Answer: B

Bubu3k is correct, "B" is the correct answer.

upvoted 3 times

...