MENU
Refer to the exhibit.
Refer to the exhibit. An engineer must configure an IPsec VPN connection between site 1 and site 2. The indicated configuration was applied to router R1; however, the tunnel fails to come up. Which command must be run on R1 to resolve the issue?
A. ip route 0.0.0.0 0.0.0.0 10.1.1.2 B. crypto isakmp key vpnuser address 192.168.20.2 C. ip route 0.0.0.0 0.0.0.0 192.168.20.2 D. crypto isakmp key vpnuser address 10.1.1.2
For a site-to-site IPsec VPN, each peer must configure a pre-shared key tied to the public IP address of the remote VPN peer:
crypto isakmp key <KEY> address <REMOTE_PUBLIC_IP>
From the diagram:
R1 outside IP: 192.168.10.1/24
R2 outside IP: 192.168.20.2/24 remote peer for R1
In the current R1 configuration, the ISAKMP key is incorrectly bound to 192.168.10.2, which is a local next-hop/ISP address on R1's own subnet, not the R2 public IP. Because the pre-shared-key address does not match the source IP of R2's IKE packets, phase 1 negotiation fails and the tunnel never comes up.
The correct configuration on R1 must therefore be:
crypto isakmp key vpnuser address 192.168.20.2
Options A and C incorrectly change the default route (next hop must be the local ISP router, not R2's public IP or a LAN address). Option D uses an internal address (10.1.1.2), which is not the IP used for IKE on the Internet.