A site-to-site VPN between two FTDs is up, but the tunnel drops and re-establishes every few minutes. `show crypto ipsec sa` shows the IPsec SA lifetime is 3600 seconds, but the tunnel drops before that. `debug crypto ikev2` shows the IKE SA is rekeying frequently. You have verified that the IKE SA lifetimes on both peers are identical. What is the most likely cause?

The NAT policy is translating the IKE rekey packets, causing them to be dropped.

The crypto map ACL is misconfigured, causing the tunnel to only carry a small subset of traffic.

The firewall policy is blocking the IPsec rekey packets.

The IPsec SA lifetime on one peer is set to a much shorter value than on the other, causing the IPsec SA to expire and the tunnel to drop.

A site-to-site VPN between two FTDs establishes successfully, but the tunnel drops and re-establishes every few minutes. `show crypto ipsec sa` shows the IPsec SA lifetime is 3600 seconds, but the tunnel drops before that. `debug crypto ikev2` shows the IKE SA is rekeying frequently. What is the most likely cause?

The crypto map ACL is misconfigured, causing the tunnel to only carry a small subset of traffic.

The NAT policy is translating the IKE rekey packets, causing them to be dropped.

The IPsec SA lifetime is set to 3600 seconds on both peers, but the tunnel drops due to a firewall policy blocking rekey traffic.

The IKE SA lifetime on one peer is set to a much shorter value than on the other, causing frequent rekeys.

A site-to-site VPN between two FTDs is failing to establish. You run `debug crypto ikev2` on the local FTD and see that the IKE_SA_INIT is sent, but no response is received. The remote FTD's outside interface is reachable via ping. What is the most likely cause?

The local FTD's crypto map is configured with the wrong peer IP, so the IKE_SA_INIT is sent to the wrong destination.

The remote FTD's firewall policy is blocking UDP 500 and UDP 4500 from the local peer.

The IKEv2 proposal on the local FTD does not match the remote FTD's proposal.

The pre-shared key on the local FTD is incorrect.

A site-to-site VPN between two FTDs was working, but after a network team added a new NAT rule, the tunnel stopped passing traffic. The tunnel itself is up (`show vpn-sessiondb` shows active sessions), but pings from the remote subnet to the local subnet fail. Which action should you take first?

Check the crypto map ACL to ensure the remote subnet is included in the interesting traffic definition.

Review the NAT configuration to see if the new rule is translating VPN traffic that should be exempt from NAT.

Reboot the remote FTD to clear any stale security associations.

Verify that the IKEv2 proposal on both FTDs still matches.

CiscoCertified Network Professional Security

Domain 2Objective 10

2.10 Troubleshoot VPN Tunnel Establishment on Cisco Secure Firewall (FTD) 350-701 Practice Questions (Page 3)

Part of the Network Security domain, which accounts for 25% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–2 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

7concepts

25%of the exam

Questions 11–15

11expert · hard
A site-to-site VPN between two FTDs is up, but the tunnel drops and re-establishes every few minutes. `show crypto ipsec sa` shows the IPsec SA lifetime is 3600 seconds, but the tunnel drops before that. `debug crypto ikev2` shows the IKE SA is rekeying frequently. You have verified that the IKE SA lifetimes on both peers are identical. What is the most likely cause?
Select an answer first
12application · medium
A site-to-site VPN between two FTDs establishes successfully, but the tunnel drops and re-establishes every few minutes. `show crypto ipsec sa` shows the IPsec SA lifetime is 3600 seconds, but the tunnel drops before that. `debug crypto ikev2` shows the IKE SA is rekeying frequently. What is the most likely cause?
Select an answer first
13application · medium
A site-to-site VPN between two FTDs is failing to establish. You run `debug crypto ikev2` on the local FTD and see that the IKE_SA_INIT is sent, but no response is received. The remote FTD's outside interface is reachable via ping. What is the most likely cause?
Select an answer first
14application · medium
A site-to-site VPN between two FTDs was working, but after a network team added a new NAT rule, the tunnel stopped passing traffic. The tunnel itself is up (`show vpn-sessiondb` shows active sessions), but pings from the remote subnet to the local subnet fail. Which action should you take first?
Select an answer first
15foundation · easy
To troubleshoot an IKEv2 negotiation failure on FTD, which CLI command would you use to see real-time IKEv2 debug messages?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.

2.10 Troubleshoot VPN Tunnel Establishment on Cisco Secure Firewall (FTD) 350-701 Practice Questions (Page 3)

Questions 11–15

A site-to-site VPN between two FTDs is failing to establish. You run `debug crypto ikev2` on the local FTD and see that the IKE_SA_INIT is sent, but no response is received. The remote FTD's outside interface is reachable via ping. What is the most likely cause?

A site-to-site VPN between two FTDs was working, but after a network team added a new NAT rule, the tunnel stopped passing traffic. The tunnel itself is up (`show vpn-sessiondb` shows active sessions), but pings from the remote subnet to the local subnet fail. Which action should you take first?

To troubleshoot an IKEv2 negotiation failure on FTD, which CLI command would you use to see real-time IKEv2 debug messages?

Keep studying — Network Security