Match each VPN symptom with the first checks identified in the course.

### The pairs\n| Item | Matches | Why |\n|---|---|---|\n| Internet Key Exchange (IKE) does not establish | Peer reachability, identity, key, and proposals | Peers must contact one another and agree on authentication and negotiation settings. |\n| IKE is up, Internet Protocol Security (IPsec) is down | IPsec proposals and traffic selectors | The data-protection parameters or protected traffic ranges may not match. |\n| IPsec is up, but applications fail | Routes, policy, Network Address Translation (NAT), and host firewall | The tunnel may work while forwarding, permission, translation, or endpoint filtering fails. |\n| Only one direction works | Return path and session-initiation rules | The reverse traffic may lack a route or may not be permitted as expected. |\n\n### Terms\n- **IKE**: Internet Key Exchange, which negotiates peer security.\n- **IPsec**: Internet Protocol Security, which protects IP traffic.\n- **NAT**: Network Address Translation, which changes packet addresses.\n\n### Remember\nMatch the checks to the failed stage instead of troubleshooting every layer at random.