IKE is established, but the IPsec association is down. Which checks best match the course troubleshooting guidance?

### Why this is right\nWhen IKE is up but IPsec is down, the course points to incompatible IPsec proposals or traffic selectors. These determine the data protection settings and traffic ranges for the CHILD SA.\n\n### The concept\nIKE negotiation has stages. Initial IKE connectivity does not guarantee that peers can agree on the settings for user traffic. Traffic selectors identify which traffic the association protects. Troubleshoot the failing stage rather than changing unrelated settings.\n\n### The other options\n- **Check only the user's web browser cache.** Browser state does not explain why the IPsec association failed to establish.\n- **Replace the remote LAN route with a default route immediately.** Routing is a likely check when the tunnel is up but traffic fails, not the first diagnosis for an IPsec negotiation failure.\n- **Disable peer authentication.** Authentication is a security requirement, not a sound diagnostic fix.\n\n### Remember\nIKE up with IPsec down points first to IPsec proposals and selectors.