300-410 ENARSI: Implementing Cisco Enterprise Advanced Routing and ServicesDemo

By Cisco · Question Mode

QuestionQ384

VPN Technologies

Refer to the exhibit. After IPsec was applied, the engineer observed that the DMVPN tunnel went down, and neither spoke-to-spoke nor hub connectivity was establishing.

Which two actions resolve the issue?

Question Image

Choose two
  • A Change the mode from mode tunnel to mode transport on R3.
  • B Remove the crypto isakmp key cisco address 10.1.1.1 on R2 and R3.
  • C Configure the crypto isakmp key cisco address 192.1.1.1 on R2 and R3.
  • D Configure the crypto isakmp key cisco address 0.0.0.0 on R2 and R3.
  • E Change the mode from mode transport to mode tunnel on R2.
Explanation

GRE-based DMVPN protected with an IPsec profile uses IPsec transport mode; R3 must therefore change from tunnel mode to transport mode. The IKE pre-shared key on DMVPN spokes must match dynamically discovered NBMA peers for spoke-to-spoke tunnels, so configuring the key with the wildcard address 0.0.0.0 permits authentication of the hub and dynamically learned spokes. Cisco DMVPN examples use mode transport and a wildcard ISAKMP key for this design.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!