Remote employees must connect with Cisco Secure Client to a Cisco Secure Firewall (FTD) and send all traffic through the tunnel. Which set of components does the remote access VPN policy need?
Select an answer to reveal the explanation.
Short Explanation
Remote access VPN needs five building blocks you can count on one hand: a connection profile to land on, a group policy for user settings, an address pool for client IPs, AAA to check who you are, and a certificate so clients trust the firewall. Mix in site-to-site pieces or ISE guest bits and you've built the wrong house.
Full Explanation
A remote access VPN on FTD is assembled from a few elements. The connection profile defines how a user's connection is handled, including which AAA servers authenticate the user and which group policy applies. The group policy carries session attributes such as tunneling mode, DNS servers and timeouts, and full tunneling means all client traffic is sent through the tunnel. An address pool supplies inside addresses to clients. The AAA server, such as a RADIUS server or directory, validates credentials, and a device identity certificate lets Secure Client verify the firewall during the TLS or IKEv2 handshake. Site-to-site topologies, crypto maps and per-user preshared keys belong to gateway-to-gateway tunnels and do not scale or apply to individual users. Decryption, intrusion and URL policies can inspect traffic once it leaves the tunnel, but they are optional security layers and do not make the VPN function. Guest portals, posture policies and VLAN assignment are network access control features delivered by ISE for wired and wireless access; posture can be integrated with VPN, but it is not one of the required building blocks. Exam caveat: the client package must also be available to the headend for first-time deployment. Operational check: connect a test client, confirm it receives an address from the pool, and verify the session shows the expected group policy.