H12-731-ENU 試験問題を無料オンラインアクセス

For the description of NAT Server, which is correct?

• A.If the public network address of the NAT Server and the corresponding public network interface address are not in the same network segment, you do not need to configure black hole routing.
• B.NAT Server cannot be configured on the virtual firewall for users of the root firewall.
• C.If the public network address of the NAT Server and the corresponding public network interface address are in the same network segment, you do not need to configure black hole routing.
• D.If the public network address of the NAT Server is the interface address, if the black hole route of this address is configured, the service access to the firewall itself will be abnormal.

Which of the following descriptions about dual-system hot standby is incorrect?

• A.After automatic backup is enabled, all sessions on the host will be automatically backed up to the standby.
• B.After enabling fast backup, the configuration of the host can also be backed up to the standby.
• C.The firewall configuration backup direction must be from the VGMP master state device to the backup state device.
• D.VGMP is currently in the active state. After the VRRP interface belonging to the VGMP goes down, the VGMP state will definitely switch to the standby state.

The main differences between the RADIUS and HWTACACS protocols include:

• A.HWTACACS supports authorization of configuration commands, RADIUS does not support authorization of configuration commands.
• B.RADIUS uses TCP protocol, network transmission is more reliable, HWTACACS uses UDP protocol.
• C.HWTACACS encrypts the entire body of the message, and RADIUS only encrypts the password field in the authentication message.
• D.RADIUS authentication and authorization are separated, and HWTACACS authentication and authorization are processed together.

A customer network topology is shown in the figure.

An LZTP tunnel is established between the PC and the FW, with the PC as the client and the FW as the LNS side. After the administrator completes the configuration, it is found that the L2TP tunnel cannot be established successfully.
Execute the command debug l2tp packet in the user view to enable the debug switch, and see the following debug information:
USG %%01L2TP/8/L2TDBG (d): L2TP::Check SCCRQ MSG Type 1
USG %%01L2TP/8/L2TDBG (d): L2TP::Parse AVP Protocol version: 100
USG %%01L2TP/8/L2TDBG (d): L2TP::Parse AVP Framing capability: 1
USG %%01L2TP/8/L2TDBG (d): L2TP::Parse AVP Bearer capability, value: 0
USG %%01L2TP/8/L2TDBG (d): L2TP::Parse AVP Firmware revision, value: 1200
USG %%01L2TP/8/L2TDBG (d): L2TP::Parse AVP Host name, value: maple-54b160e59
USG %%01L2TP/8/L2TDBG (d): L2TP::requested Host isn't in the define l2tp group, refuse the requested
USG %%01L2TP/8/L2TDBG (d): L2TP::Clear Calls On Tunnel ID=1 Reason=1
Based on the above information, which failure analysis option is correct?

• A.LNS remote tunnel name configuration is incorrect
• B.L2TP Group tunnel authentication failed
• C.Client LNS IP address configuration error
• D.The Virtual Template interface is not added to the security domain

View the session table information on the firewall as follows:
[USG] display firewall session table verbose
icmp VPN: public --> public
Zone: trust --> untrust TTL: 00:00:20 Left: 00:00:15
Interface: GigabitEthernet0/0/4 Nexthop: 2.2.2.2 MAC: 00-00-00-00-00-00
<-- packets: 0 bytes: 0 --> packets: 5 bytes: 420
192.168.1.2:44012[1.1.1.3:6103] --> 2.2.2.2:2048
The following descriptions are correct:

• A.NAT destination address one-to-one address mapping is configured on the firewall.
• B.The device at address 1.1.1.3 is pinging the public address 2.2.2.2.
• C.NAPT source address many-to-one address mapping is configured on the firewall.
• D.The device at address 192.160.1.2 is pinging the public address 2.2.2.2.