A newly acquired company uses 192.168.10.0/24 internally, which is also used at headquarters. A site-to-site VPN between the two Cisco Secure Firewall (FTD) devices must let hosts at each site reach the other. Which design makes this possible?
Select an answer to reveal the explanation.
Short Explanation
If both sites live at the same street address, the mail carrier can't tell which house a letter belongs to. NAT gives one site a new, unique address on the outside so traffic finds the right home. You'll see answers that sound technical, like NAT-T or IKEv2, but neither renames anything.
Full Explanation
When two sites use the same prefix, a host cannot reach a remote address that also appears to be local; its traffic never leaves the LAN, and the firewall cannot route a destination that matches its own inside network. The solution is to present at least one site under a different, unique prefix. NAT on the FTD translates the overlapping subnet to a mapped subnet, often in both directions with twice NAT, and the VPN protected networks are defined using the mapped addresses, so the encrypted traffic carries unique addresses end to end while hosts keep their original addressing. IKEv2 traffic selectors describe which addresses a child security association protects; they do not create unique addresses or resolve routing ambiguity. NAT traversal wraps IKE and ESP in UDP 4500 so tunnels survive address translation between peers; it addresses the peers' outer addresses, not overlapping inner networks. A NAT exemption, implemented as identity NAT, deliberately keeps addresses unchanged, which preserves the overlap rather than removing it. Exam caveat: DNS often needs adjusting so users resolve remote servers to the mapped addresses. Operational check: run packet tracing for a test flow, confirm the source or destination is translated to the mapped subnet before encryption, and verify the IPsec security association lists the mapped networks.