Exam 300-730 topic 1 question 153 discussion

Actual exam question from Cisco's 300-730

Question #: 153
Topic #: 1

A network administrator is troubleshooting a FlexVPN tunnel. The hub router is unable to ping the spoke router's tunnel interface IP address of 192.168.1.2, even though the tunnel is showing up. The output of the debug ip packet CLI command on the hub router shows the following entry.

IP: tableid=0123456789 s=192.168.1.1 (local), d=192.168.1.2 (loopback2), routed via FIB.

What must be configured to fix this issue?

A. A matching IKEv2 pre-shared key on the hub and spoke routers in the crypto keyring configuration.
B. An outbound ACL on the dynamic VTI of the hub router that allows ICMP traffic to 192.168.1.2.
C. An IKEv2 authorization policy must be configured on the spoke router to advertise the interface route.
D. A route map must be configured on hub router to set the next hop for 192.168.1.2 to the dynamic VTI.

Show Suggested Answer

Suggested Answer: D 🗳️

by red_sparrow_Gr at Feb. 9, 2023, 7:47 a.m.

Comments

Submit Cancel

DGriff

4 months, 3 weeks ago

Selected Answer: D

A Hub and spoke may not need to use an authorization policy, especially using VTI.

upvoted 1 times

...

aksh9901

6 months, 2 weeks ago

Selected Answer: C

the hub router’s debug output indicates that it is trying to send the packet toward the spoke’s tunnel IP (192.168.1.2) but is doing so “via FIB” (i.e., the routing table) rather than across the FlexVPN tunnel. In other words, the hub either does not know that 192.168.1.2 is reachable via the FlexVPN tunnel or has no correct route/next-hop entry pointing to the tunnel interface.Once the spoke is correctly advertising 192.168.1.2 to the hub via the authorization policy, the hub’s routing table will reflect that the next hop for 192.168.1.2 is via the dynamic VTI, and pings from the hub to the spoke tunnel IP will work as intended.

upvoted 1 times

...

jedi567890

9 months, 3 weeks ago

Selected Answer: C

"route set interface" must be set under spoke's authorization policy in order to advertise its tunnel ip to the hub.

upvoted 1 times

...

pfrank

11 months ago

Selected Answer: D

If you can't ping the spoke and debug shows FIB then this would seem to be a routing issue.

upvoted 2 times

...

kylesam2017

1 year ago

"D" is the correct answer here.

upvoted 2 times

...

gondohwe

1 year, 1 month ago

hub cant reach spoke interface even if it shows to be up because spoke isnt definately advertising its network via IKEv2 authorization policy....i choose C

upvoted 2 times

...

red_sparrow_Gr

1 year, 11 months ago

I am not sure if C is the correct one or D.

upvoted 1 times

mpls_link

1 year, 8 months ago

C is the most correct answer!

upvoted 2 times

...