A branch Cisco Secure Firewall (FTD) and an HQ FTD, both managed by the same management center, need a site-to-site IPsec tunnel between 10.20.0.0/16 and 10.1.0.0/16. Which set of elements defines this VPN topology?
Select an answer to reveal the explanation.
Short Explanation
A site-to-site tunnel is basically a contract between two firewalls: who are we, which networks do we protect, and how do we encrypt. Endpoints, protected networks, IKE version and proposals are that contract. Address pools and group policies belong to remote access VPN, so you can leave them out here.
Full Explanation
A site-to-site VPN topology on the management center describes the two endpoints, the protected networks behind each, and the cryptographic parameters both sides must agree on. That includes the IKE version, IKE policies for the control channel and IPsec proposals for the data channel, plus the authentication method such as a preshared key or certificates. With both devices in the same management center, the same topology is pushed to each side, which keeps protected networks mirrored and proposals consistent. Address pools, group policies and client profiles are remote access VPN elements: they assign addresses and attributes to individual users connecting with Secure Client and play no role between two gateways. VLANs, native VLAN settings and EtherChannels are Layer 2 constructs; a site-to-site tunnel is built across a routed path between the two outside interfaces, so these settings are unrelated. Routing protocols may run over a route-based tunnel interface, but they are not what defines the topology; a policy-based tunnel works with static protected networks and no routing protocol at all. Exam caveat: route-based VPN uses virtual tunnel interfaces and routing to choose traffic, whereas policy-based VPN uses protected network definitions, so read which model the scenario implies. Operational check: deploy, generate traffic between the networks, and confirm IKE and IPsec security associations are established.