Câu 20: JN0-696: Juniper Networks Certified Support Professional Security (JNCSP-SEC)

-- Exhibit --user@R1> show security ike security-associationsuser@R1> show security zonesSecurity zone: trust -Send reset for non-SYN session TCP packets: OffPolicy configurable: Yes -Interfaces bounD. 3 -Interfaces:ge-0/0/0.0ge-0/0/6.0lo0.0Security zone: untrust -Send reset for non-SYN session TCP packets: OffPolicy configurable: Yes -Interfaces bounD. 1 -Interfaces:ge-0/0/1.0Security zone: junos-host -Send reset for non-SYN session TCP packets: OffPolicy configurable: Yes -Interfaces bounD. 0 -Interfaces:user@R1> show interfaces st0Physical interface: st0, Enabled, Physical link is UpInterface index: 130, SNMP ifIndex: 503Type: Secure-Tunnel, Link-level type: Secure-Tunnel, MTU: 9192Device flags : Present RunningInterface flags: Point-To-Point -Input rate : 0 bps (0 pps)Output rate : 0 bps (0 pps)Logical interface st0.0 (Index 72) (SNMP ifIndex 546)Flags: Link-Layer-Down Point-To-Point SNMP-TrapsEncapsulation: Secure-Tunnel -Input packets : 3 -Output packets: 3 -Security: Zone: Null -Protocol inet, MTU: 9192 -Flags: Sendbcast-pkt-to-re -Addresses, Flags: Dest-route-down Is-Preferred Is-PrimaryDestination: 172.19.0.0/30, Local: 172.19.0.1user@R1> show interfaces ge-0/0/1Physical interface: ge-0/0/1, Enabled, Physical link is UpInterface index: 135, SNMP ifIndex: 508Link-level type: Ethernet, MTU: 1514, Link-mode: Full-duplex, SpeeD. 1000mbps,BPDU Error: None, MAC-REWRITE Error: None, Loopback: Disabled,Source filtering: Disabled, Flow control: Enabled, Auto-negotiation: Enabled,Remote fault: Online -Device flags : Present RunningInterface flags: SNMP-Traps Internal: 0x0Link flags : None -CoS queues : 8 supported, 8 maximum usable queuesCurrent address: b0:c6:9a:73:27:81, Hardware address: b0:c6:9a:73:27:81Last flapped : 2013-06-12 15:22:48 UTC (00:59:41 ago)Input rate : 0 bps (0 pps)Output rate : 0 bps (0 pps)Active alarms : None -Active defects : None -Interface transmit statistics: DisabledLogical interface ge-0/0/1.0 (Index 71) (SNMP ifIndex 541)Flags: SNMP-Traps 0x0 Encapsulation: ENET2Input packets : 40 -Output packets: 27 -Security: Zone: untrust -Allowed host-inbound traffic : pingProtocol inet, MTU: 1500 -Flags: Sendbcast-pkt-to-re -Addresses, Flags: Is-Preferred Is-PrimaryDestination: 184.0.15.0/30, Local: 184.0.15.1, Broadcast: 184.0.15.3 user@R1> show log ipsec-trace | match "500|drop"Jun 12 16:32:10 16:32:10.680034:CID-0:RT:ageout 71,184.0.15.2/500->184.0.15.1/500,17, (0/0)Jun 12 16:32:51 16:32:51.874191:CID-0:RT:184.0.15.2/500->184.0.15.1/500;17> :Jun 12 16:32:51 16:32:51.874191:CID-0:RT: ge-0/0/1.0:184.0.15.2/500->184.0.15.1/500, udpJun 12 16:32:51 16:32:51.874191:CID-0:RT: find flow: table 0x4f160b38, hash 8769(0xffff), sa 184.0.15.2, da 184.0.15.1, sp 500, dp 500, proto 17, tok 8Jun 12 16:32:51 16:32:51.874191:CID-0:RT:pak_for_self : proto 17, dst port 500, action 0x0Jun 12 16:32:51 16:32:51.874191:CID-0:RT: flow_first_in_dst_nat: in 0/1.0>, out A> dst_adr 184.0.15.1, sp 500, dp 500Jun 12 16:32:51 16:32:51.874555:CID-0:RT: packet droppeD. for self but not interestedJun 12 16:32:51 16:32:51.874555:CID-0:RT: packet dropped, packet droppeD. for self but not interested. Jun 12 16:32:54 16:32:54.680399:CID-0:RT:ageout 71,184.0.15.2/500->184.0.15.1/500,17, (0/0)Jun 12 16:32:56 16:32:56.888094:CID-0:RT:184.0.15.2/500->184.0.15.1/500;17> :Jun 12 16:32:56 16:32:56.888094:CID-0:RT: ge-0/0/1.0:184.0.15.2/500->184.0.15.1/500, udpJun 12 16:32:56 16:32:56.888094:CID-0:RT: find flow: table 0x4f160b38, hash 8769(0xffff), sa 184.0.15.2, da 184.0.15.1, sp 500, dp 500, proto 17, tok 8Jun 12 16:32:56 16:32:56.888094:CID-0:RT:pak_for_self : proto 17, dst port 500, action 0x0Jun 12 16:32:56 16:32:56.888094:CID-0:RT: flow_first_in_dst_nat: in 0/1.0>, out A> dst_adr 184.0.15.1, sp 500, dp 500Jun 12 16:32:56 16:32:56.888094:CID-0:RT: packet droppeD. for self but not interestedJun 12 16:32:56 16:32:56.888094:CID-0:RT: packet dropped, packet droppeD. for self but not interested. Jun 12 16:33:00 16:33:00.680794:CID-0:RT:ageout 71,184.0.15.2/500->184.0.15.1/500,17, (0/0)Jun 12 16:33:07 16:33:06.902220:CID-0:RT:184.0.15.2/500->184.0.15.1/500;17> :Jun 12 16:33:07 16:33:06.902220:CID-0:RT: ge-0/0/1.0:184.0.15.2/500->184.0.15.1/500, udpJun 12 16:33:07 16:33:06.902220:CID-0:RT: find flow: table 0x4f160b38, hash 8769(0xffff), sa 184.0.15.2, da 184.0.15.1, sp 500, dp 500, proto 17, tok 8Jun 12 16:33:07 16:33:06.902220:CID-0:RT:pak_for_self : proto 17, dst port 500, action 0x0Jun 12 16:33:07 16:33:06.902220:CID-0:RT: flow_first_in_dst_nat: in 0/1.0>, out A> dst_adr 184.0.15.1, sp 500, dp 500Jun 12 16:33:07 16:33:06.902220:CID-0:RT: packet droppeD. for self but not interestedJun 12 16:33:07 16:33:06.902220:CID-0:RT: packet dropped, packet droppeD. for self but not interested.-- Exhibit --Click the Exhibit button. You are asked to troubleshoot a new IPsec tunnel that is not establishing between R1 and R2. The remote team has verified that R2's configuration is correct. Referring to the exhibit, which two actions are required to resolve the problem? (Choose two.)

1. A. Add the st0.0 interface to a security zone. — đáp án hiện tại
2. B. Change the st0.0 interface MTU to 1400.
3. C. Enable IKE for host inbound traffic in the untrust zone. — đáp án hiện tại
4. D. Enable IKE for host inbound traffic in the trust zone.