A security engineer sets up one Secure Firewall Threat Defense appliance for two VPNs: Cisco Secure Client remote access for 50 mobile employees and an IKEv2 site-to-site tunnel to a partner that authenticates with a pre-shared key. The site has no RADIUS server, and every remote client must receive an address from a pool defined on the FTD. Which configuration supplies those client addresses?
Select an answer to reveal the explanation.
Short Explanation
You can have the FTD assign each remote-access client an address from the IPv4 address pool on its connection profile. That keeps address assignment on the FTD, just as the setup requires, without depending on an external address service.
Full Explanation
An IPv4 address pool on the FTD’s remote-access connection profile supplies addresses locally to authenticated Cisco Secure Client clients, matching the requirement that the pool be defined on the FTD. A RADIUS server returning a Framed-IP-Address can provide per-user addresses, but this site has no RADIUS server, so that method is unavailable. A LAN DHCP server with the FTD acting as a DHCP relay can centralize address assignment, but the pool would be on the LAN server rather than on the FTD, contrary to the requirement. A second Secure Firewall headend with a local pool could assign addresses to remote-access clients, but it would not meet the requirement to set up one FTD appliance for both VPNs. Exam caveat: the partner’s IKEv2 pre-shared key authenticates the site-to-site tunnel; it does not assign addresses to Cisco Secure Client users. Practical check: confirm that the FTD pool has enough addresses for the 50 employees and does not overlap networks reachable through the VPN or the clients’ local networks.