300-730 question 1: An engineer is troubleshooting a new DMVPN configuration on a Cisco…

Q1Site-to-site Virtual Private Networks on Routers and Firewalls

An engineer is troubleshooting a new DMVPN configuration on a Cisco IOS router. After issuing the `show crypto isakmp sa` command, the returned response is `MM_NO_STATE`. Why does this failure occur?

← → navigate · a answer

Community votes

92% (11)

8% (1)

0% (0)

Discussion · 18

correct answer is C

C is the correct answer, it is because of a policy mismatch for phase 1

C 1

Selected Answer: C like Slysloth wrote C should be correct

Correct answer is C https://www.cisco.com/c/en/us/support/docs/security/dynamic-multipoint-vpn-dmvpn/111976-dmvpn-troubleshoot-00.html

C 1

Selected Answer: C Correct answer is C

C 1

Selected Answer: C correct answer is C

ISAKMP SA has been created but not formed. https://www.tunnelsup.com/isakmp-ike-phase-1-status-messages/

C 1

Selected Answer: C C is the only logical one, MM is for main mode

C 1

Selected Answer: C Phase 1 failed

C 1

Selected Answer: C C is correct

B 1

Selected Answer: B B- is also correct , this should be the first assumption if no other details were given C- is also correct , but this should be the 2nd assumption ?

policy not matching e.g authentication key....go for C

"C" is the correct answer here.

C 1

Selected Answer: C phase 1 failed so non matching. human error is always first asumption

Answer options B & D are for phase 2, so they are ruled out. From A & C, answer looks like C because phase 1 means main mode, which has no state as shown by the error message - 'MM_NO_STATE'.

C 1

Selected Answer: C Answer is C. ISAKMP packets would be dropped if that were the case, not ESP packets.

C 1

Selected Answer: C should be C A show crypto isakmp sa command shows the ISAKMP SA inMM_NO_STATE. This also means that main mode has failed. dst src state conn-id slot 10.1.1.2 10.1.1.1 MM_NO_STATE 1 0 Check that the phase 1 policy exists on both peers, and make sure every attribute matches. https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409-ipsec-debug-00.html#toc-hId--70669866

C 1

Selected Answer: C B and D will give you the MM_NO_STATE temporarily if they were configured and then removed, and they will end up staying in QM_IDLE so if they were never configured the MM_NO_STATE will not show up, but C will always give you MM_NO_STATE