Which two actions resolve the issue?

Refer to the exhibit.

After applying IPsec, the engineer observed that the DMVPN tunnel went down, and both spoke-to-spoke and hub were not establishing.

Which two actions resolve the issue? (Choose two.)
A . Change the mode from mode tunnel to mode transport on R3.
B . Remove the crypto isakmp key cisco address 10.1.1.1 on R2 and R3.
C . Configure the crypto isakmp key cisco address 192.1.1.1 on R2 and R3.
D . Configure the crypto isakmp key cisco address 0. 0. 0. 0 on R2 and R3.
E . Change the mode from mode transport to mode tunnel on R2.

View Answer

Answer: AD

Explanation:

The first six commands are used to configure IPSec Phase 1(ISAKMP Policy).

Here is the details of each command used above:

+ crypto isakmp policy 10-This command creates ISAKMP policy number 10. You can create multiple policies, for example 7, 8, 9 with different configuration. Routers participating in Phase 1 negotiation tries to match a ISAKMP policy matching against the list of policies one by one. If any policy is matched, the IPSec negotiation moves to Phase 2

+ hash md 5-MD 5 algorithm will be used

+ authentication pre-share-Authentication method is pre-shared key.

+ group 2-Diffie-Hellman group to be used is group 2

+ encryption 3des-3DES encryption algorithm will be used for Phase 1.

+ crypto isakmp key cisco address 10.1.1.1-The Phase 1 password is cisco and remote peer IP

address is 10.1.1.1

The next two command lines are used to configure IPSec Phase 2(Transform Set)

+ crypto IPSec transform-set<transform-set-name>-Creates transform-set called<transform-

set-name>

+ esp-des-ESP IPSec protocol with the 56-bit Data Encryption Standard(DES) encryption

algorithm will be used

+ esp-md 5-hmac-ESP with the MD 5(HMAC variant) authentication algorithm will be used.

+mode transport: only encrypts the payload and ESP trailer

or

+ mode tunnel: encrypts the IP header of the ENTIRE packet