Exam 300-101 topic 1 question 156 discussion

Actual exam question from Cisco's 300-101

Question #: 156
Topic #: 1

Refer to the exhibit. A network engineer is troubleshooting a DMVPN setup between the hub and the spoke. The engineer executes the command show crypto isakmp sa and observes the output that is displayed. What is the problem?

A. that ISAKMP is using default settings
B. an incompatible ISAKMP policy
C. an incompatible IPsec transform set
D. that ISAKMP is not enabled

Show Suggested Answer

Suggested Answer: A 🗳️
Reference:
http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409-ipsec-debug-00.html

by Bastex at Sept. 17, 2019, 7:23 a.m.

Comments

Submit Cancel

black_chechos

5 years, 7 months ago

Answer C

upvoted 1 times

...

IanC

5 years, 8 months ago

QM_IDLE*** – The ISAKMP SA is idle and authenticated Up-Active – IPSec SA is up/active and transferring data.

upvoted 1 times

...

Bastex

5 years, 9 months ago

I think, according the reference link, correct answer is C. "This command shows the ISAKMP SA built between peers. dst src state conn-id slot 12.1.1.2 12.1.1.1 QM_IDLE 1 0 In the show crypto isakmp sa output, the state should always be QM_IDLE." Thus, Phase 1 - OK, and the problem is on Phase 2, for example incompatible transform set.

upvoted 1 times

...