HPE7-A10: HPE Network Security Expert Written ExamDemo

By HP · Question Mode

QuestionQ59

Analyze

Refer to the exhibit, which depicts the topology for an HPE Aruba Networking network.

Question Image

The gateways have sent the following logs to your Syslog server.

<142>Jan 9 18:01:15 GW1 authmgr[6118]: <124039> <6118> Time-range night-hours activated  
<142>Jan 9 18:01:15 GW1 authmgr[6118]: <124040> <6118> Time-range working-hours deactivated  
<142>Jan 9 18:13:07 GW2 authmgr[6159]: <124709> <6159> Drop ARP-packet with unknown-IP: smac:a0:e7:7b:97:a2:98 sender-mac: a0:e7:7b:97:a2:98 sender-ip:10.1.30.2  
<142>Jan 9 18:13:38 GW2 authmgr[6159]: <124709> <6159> Drop ARP-packet with unknown-IP: smac: a0:e7:7b:97:a2:98 sender-mac: a0:e7:7b:97:a2:98 senderip:10.1.30.2  
<142>Jan 9 18:21:24 GW2 isakmpd[6132]: <103076> <6132> IKEv2 IPSEC Tunnel created for peer 10.1.30.2:500  
<142>Jan 9 18:21:24 GW2 isakmpd[6132]: <103101> <6132> IPSEC SA deleted for peer 10.1.30.2  
<142>Jan 9 18:21:24 GW2 isakmpd[6132): <103078> <6132> IKEv2 CHILDSA successful for peer 10.1.30.2:500  
<142>Jan 9 18:21:26 GW1 isakmpd[6091]: <103076> <6091> IKEv2 IPSEC Tunnel created for peer 10.1.30.3:500  
<142>Jan 9 18:21:26 GW1 isakmpd[6091]: <103101> <6091> IPSEC SA deleted for peer 10.1.30.3  
<142>Jan 9 18:21:26 GW1 isakmpd[6091]: <103078> <6091> IKEv2 CHILDSA successful for peer 10.1.30.3:500

What potential security issue can be identified from these logs?

  • A A rogue admin is deleting IPsec configuration on the gateways.
  • B The gateways are using a legacy form of IKE, which is no longer secure.
  • C A client is trying to spoof a gateway IP address.
  • D The gateways are dropping legitimate ARP traffic due to a misconfiguration.
Explanation

An unrecognized MAC address is sending ARP packets that claim sender IP address 10.1.30.2, which is assigned to a gateway peer. That mismatch is consistent with an attempt to spoof a gateway IP address through ARP. The gateway appropriately drops the packets. IKEv2 is the current IKE protocol version, and IPsec SA lifecycle messages do not indicate deletion of the IPsec configuration. Aruba documents gateway-cluster and VRRP configuration, including the virtual-router IP used for redundancy.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!