Exam NGFW-Engineer Topic 1 Question 21 Discussion
Actual exam question for Palo Alto Networks's NGFW-Engineer exam
Question #: 21
Topic #: 1
Question #: 21
Topic #: 1
After an engineer configures an IPSec tunnel with a Cisco ASA, the Palo Alto Networks firewall generates system messages reporting the tunnel is failing to establish.
Which of the following actions will resolve this issue?
Which of the following actions will resolve this issue?
Suggested Answer: B Vote an answer
Basic Concept: When interoperating with policy-based VPN devices such as Cisco ASA or Check Point, Proxy IDs identify the local and remote selectors that must match Phase 2/IPSec SAs.
Why B is Correct: Matching Proxy IDs resolves the failure because the ASA expects specific encryption domains; without matching selectors, IKE Phase 2 negotiation fails or traffic does not match the correct SA.
Why A is Wrong: Ensure that an active static or dynamic route exists for the VPN peer with next hop as the tunnel interface. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.
Why C is Wrong: Check that IPSec is enabled in the management profile on the external interface. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.
Why D is Wrong: Validate the tunnel interface VLAN against the peer's configuration. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.
Why B is Correct: Matching Proxy IDs resolves the failure because the ASA expects specific encryption domains; without matching selectors, IKE Phase 2 negotiation fails or traffic does not match the correct SA.
Why A is Wrong: Ensure that an active static or dynamic route exists for the VPN peer with next hop as the tunnel interface. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.
Why C is Wrong: Check that IPSec is enabled in the management profile on the external interface. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.
Why D is Wrong: Validate the tunnel interface VLAN against the peer's configuration. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.
by Roderick at Oct 01, 2026, 11:53 PM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).