Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) v1.2SecurityHard
A network engineer is configuring a FlexVPN solution to provide secure remote access for mobile users. The design requires that remote users authenticate using username and password against an external RADIUS server, and that the VPN client automatically receives an IP address from a pool on the headend router. Which IKEv2 configuration element is primarily responsible for defining the authentication method and addressing parameters for these remote access clients?
- AIKEv2 Profile
- BIPsec Profile
- CIKEv2 Proposal
- DCrypto Map
Show answer & explanationAnswer & explanation
Correct answer: A. IKEv2 Profile
In FlexVPN, the IKEv2 Profile is a crucial component that defines the local and remote authentication methods (e.g., pre-shared key, EAP, certificate), identifies the remote peer, and specifies client configuration parameters like IP address assignment (from a local pool or DHCP) and DNS servers. It acts as a central point for IKEv2 policy and client settings.
Why the other options are wrong
- B. An IPsec Profile defines the IPsec transform set and other IPsec-specific parameters for Phase 2, not IKEv2 authentication or client addressing.
- C. An IKEv2 Proposal defines the cryptographic parameters (encryption, integrity, DH group) for the IKEv2 SA, not authentication methods or client addressing.
- D. A Crypto Map (used in traditional IPsec) binds IKE/IPsec policies to an interface and defines interesting traffic, but FlexVPN uses profiles for more granular control.
FlexVPN IKEv2 Profile
A configuration element in Cisco FlexVPN that defines the IKEv2 policy, authentication methods, peer identity, and client configuration parameters for VPN connections.
- Specifies local and remote authentication methods (e.g., pre-shared key, EAP, certificate).
- Identifies the remote peer (e.g., by FQDN, IP address).
- Configures client parameters such as IP address assignment, DNS servers, WINS servers.
- Links to IKEv2 proposals and IPsec profiles.
Memory trick: FlexVPN Pieces: Proposal, Profile, IPsec, Map