300-540 Exam Dumps - Designing and Implementing Cisco Service Provider Cloud Network Infrastructure (SPCNI v1.0)

For a site-to-site IPsec VPN, each peer must configure apre-shared keytied to thepublic IP address of the remote VPN peer:

crypto isakmp key address

From the diagram:

R1 outside IP:192.168.10.1/24

R2 outside IP:192.168.20.2/24← remote peer for R1

In the current R1 configuration, the ISAKMP key is incorrectly bound to192.168.10.2, which is a local next-hop/ISP address on R1’s own subnet, not the R2 public IP. Because the pre-shared-key address does not match the source IP of R2’s IKE packets, phase 1 negotiation fails and the tunnel never comes up.

The correct configuration on R1 must therefore be:

crypto isakmp key vpnuser address 192.168.20.2

Options A and C incorrectly change the default route (next hop must be the local ISP router, not R2’s public IP or a LAN address). Option D uses an internal address (10.1.1.2), which is not the IP used for IKE on the Internet.

For asite-to-site IPsec VPN, each peer must point to thereachable IP address of the remote VPN endpoint—that is, the IP address on the WAN/Internet-facing interface of the remote router.

From the diagram:

R1 outside (toward Internet):192.168.10.1

R2 outside (toward Internet):192.168.20.2

Inside LANs:

Site 1:10.1.0.0/24

Site 2:10.2.0.0/24

The crypto map on R1 uses:

crypto map mymap 10 ipsec-isakmp

set transform-set myset

match address 101

set peer

The must be the IP address where R1 can actually reach the IPsec peer, which is R2’s Internet-facing interface192.168.20.2.

If the peer were configured with a LAN IP such as 10.2.0.1 (site 2’s internal gateway), IKE packets would never reach the remote router because that address is not routable over the Internet.

Therefore, the correct command to bring up the VPN is:

set peer 192.168.20.2

Option A (10.1.0.1)– local LAN IP (R1’s side), not the remote endpoint.

Option C (192.168.10.1)– R1’s own WAN IP, not the remote peer.

Option D (10.2.0.1)– remote LAN IP, not reachable directly over the Internet.