Cisco 300-730 SVPN flashcards
Cisco 300-730 SVPN · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- IKEv2 initial exchange
- IKE_SA_INIT (2 messages) negotiates proposals and DH; IKE_AUTH (2 messages) authenticates peers and creates the first CHILD_SA. Four messages total for a basic tunnel.
- IKEv1 aggressive mode
- Three-message Phase 1 exchange that exposes the peer identity in cleartext and allows offline preshared-key guessing. Main mode hides identity and uses six messages.
- ESP versus AH
- ESP encrypts payload and provides integrity; AH provides integrity only and hashes the IP header, so AH fails through NAT. Use ESP with NAT-T for internet deployments.
- NAT Traversal UDP 4500
- When NAT is detected, ESP is encapsulated in UDP port 4500. Firewalls must permit UDP 500 for IKE and UDP 4500 for NAT-T bidirectionally.
- Perfect Forward Secrecy
- Forces a fresh DH exchange for each IPsec rekey so compromise of one key does not expose other SAs. Both peers must use the same DH group.
- AES-GCM in IPsec
- Combined-mode cipher providing encryption and integrity in one operation. The ESP integrity algorithm is not used for data; PRF and integrity still apply to IKE.
- Crypto ACL purpose
- Selects traffic to encrypt. On IOS it matches outbound traffic only; on ASA the same ACL is evaluated in both directions and must mirror peer subnets.
- SVTI versus DVTI
- SVTI is a static point-to-point tunnel interface. DVTI uses a virtual template to clone per-spoke tunnels dynamically, common for hub-and-spoke IKEv2 deployments.
- Proxy ID mismatch
- IKEv2 identifies traffic selectors; if the local and remote selectors do not mirror, Phase 2 fails. Verify TSr/TSi in debug crypto ikev2 and align ACLs.
- Phase 1 state QM_IDLE
- IKEv1 Phase 1 is complete and the ISAKMP SA is idle, ready for Quick Mode. MM_ACTIVE indicates an established main-mode SA.
- NO_PROPOSAL_CHOSEN
- Logged when no offered proposal matches the peer's configured policy. Check encryption, hash, DH group, and authentication method on both sides.
- INVALID_ID_INFORMATION
- Typically indicates a preshared key mismatch, wrong peer identity, or proxy-ID mismatch during IKE. Verify the PSK and peer address configuration.
- NAT exemption requirement
- VPN traffic must bypass NAT translation before encryption. On ASA, configure a static identity NAT rule for the peer subnets; otherwise packets are translated and dropped.
- ASA packet-tracer
- Simulates a packet through the ASA and reports each stage: ACL, NAT, routing, and crypto. Use detailed output to find where a VPN packet is dropped.
- AnyConnect default port
- SSL VPN uses TLS over TCP 443 by default. DTLS uses UDP 443 for the data channel and improves latency; enable DTLS on the group policy.
- Split tunneling include
- Only destinations in the split-tunnel ACL are sent through the tunnel; all other traffic goes direct. Configured as tunnelspecified on the group policy.
- Split tunneling exclude
- Listed destinations bypass the tunnel and all other traffic is tunneled. Configured as split-exclude on the group policy with an ACL of excluded networks.
- AnyConnect connection profile
- Binds authentication method, address pool, and group policy for a client connection. Referenced by the webvpn tunnel-group and selected by URL or group alias.
- AnyConnect group policy
- Defines client behavior: split tunneling, DTLS, protocols, idle timeout, and DNS. Assigned per connection profile or returned by the AAA server as an attribute.
- Clientless SSL VPN limits
- Browser-based access supports bookmarks, port forwarding, and web apps, but not full IP tunneling. Full tunnel and IKEv2 require the AnyConnect client.
- AnyConnect IKEv2 EAP
- IKEv2 remote access uses EAP for user authentication, often EAP-MSCHAPv2 with a preshared key or certificate for the gateway. Requires an IKEv2 profile on IOS.
- Always-On VPN profile
- Windows AnyConnect feature in the profile XML that starts the VPN before user logon and reconnects automatically. Configured client-side, not on the ASA.
- IKEv2 MOBIKE
- Allows an IKEv2 SA to survive client IP changes, such as Wi-Fi to cellular roaming. Supported natively in IKEv2 and useful for mobile remote access.
- DH group recommendations
- Group 14 (2048-bit MODP) is a common minimum; groups 19 and 20 (elliptic curve) are preferred. Groups 1 and 2 are deprecated and should be avoided.
- IKE and IPsec lifetimes
- Set the IPsec SA lifetime shorter than or equal to the IKE SA lifetime so rekeys occur cleanly. Mismatched lifetimes can cause brief drops during rekey.
- FlexVPN spoke-to-spoke
- IKEv2 hub-and-spoke with NHRP shortcuts lets spokes build direct tunnels. Requires matching IKEv2 profiles and AAA authorization for the shortcut.
- Route-based VPN
- Traffic is selected by routing to a tunnel interface rather than an ACL. ASA uses VTI interfaces; IOS uses SVTI or DVTI with static or dynamic routing.
- show crypto ipsec sa counters
- Displays encaps and decaps per SA. Encaps increasing with decaps at zero on the peer usually means traffic is dropped by ACL, NAT, or routing.
- ASA capture command
- capture <name> interface <if> match ip host A host B captures packets for inspection. Use show capture <name> to view and no capture to remove.
- VPN session database
- show vpn-sessiondb detail anyconnect lists active sessions, assigned addresses, and policy. Confirms client connectivity and group-policy assignment.
- TLS server certificate
- AnyConnect validates the ASA trustpoint certificate against the client trust store. The certificate subject or SAN must match the connection URL hostname.
- IKEv2 traffic selectors
- TSi and TSr define source and destination subnets for a CHILD_SA. They must mirror between peers; mismatches cause Phase 2 failure in IKEv2.