I85PREP
⌘ K
Cisco 300-730 SVPN study materials
Cisco 300-730 SVPN study resources

Cisco 300-730 SVPN: Secure communications

Cisco 300-730 SVPN · Work through your exam, one topic at a time.

All guide sections

Secure communications

Secure communications

This domain tests the cryptography and trust services under every VPN: PKI enrollment, certificate validation, IKEv1 versus IKEv2, IPsec protocols and modes, and SSL/TLS for remote access. Expect questions that ask which protocol provides confidentiality, which mode protects the original IP header, and why a certificate is rejected.

Core rules

  • PKI: a trustpoint names the CA and local key pair. Enrollment can use SCEP or EST; crypto pki authenticate obtains the CA certificate and crypto pki enroll requests the local certificate. Validation uses the chain, validity dates, and CRL or OCSP.
  • IKEv1 vs IKEv2: IKEv1 has Phase 1 main or aggressive mode and Phase 2 quick mode. IKEv2 uses IKE_SA_INIT and IKE_AUTH, supports MOBIKE, and is the basis for FlexVPN. Aggressive mode exposes identity before a secure channel and is best avoided with PSK.
  • IPsec: ESP provides confidentiality and integrity; AH provides integrity and authentication but not encryption, and AH is incompatible with NAT because it hashes the outer IP header. Transport mode protects payload; tunnel mode protects the entire original packet.
  • PFS: a new Diffie-Hellman exchange per Phase 2 creates fresh keys; both peers must agree on the PFS group.
  • SSL/TLS: TLS protects HTTPS and AnyConnect; certificate hostname validation, cipher suite overlap, and protocol version (TLS 1.2 or 1.3) must match. DTLS is TLS-like over UDP for AnyConnect data.

Worked example

An IKEv2 site-to-site tunnel using RSA signatures fails at IKE_AUTH. show crypto ikev2 sa shows no established SA. debug crypto ikev2 reports certificate validation failure. show crypto pki certificates shows the local certificate is valid, but show clock shows the router is two years behind. Reasoning: the peer rejects the certificate because its validity period appears in the future. Configure NTP, correct the clock, and retry; re-enrollment is unnecessary if the certificate itself is still valid.

Traps

A certificate with the right CN but no SAN can fail hostname checks. An unreachable CRL or OCSP responder can cause validation to fail even with a good certificate. AH is not a fix for NAT traversal. PFS mismatch fails Phase 2 while Phase 1 stays up. IKEv1 aggressive mode with PSK is vulnerable to offline dictionary attacks. For TLS, an expired or wrongly named server certificate is a trust failure, not a routing failure.