In an IPsec site-to-site VPN, both peer endpoints must be configured with compatible cryptographic parameters (such as encryption and hashing algorithms) for Phase 1 (IKE) negotiation to succeed.

### Why this is right The two VPN endpoints must agree on the settings used to identify and protect the connection. Incompatible settings or incorrect peer details can prevent negotiation. ### The concept A site-to-site VPN is negotiated between peers. Each firewall needs information about the other endpoint and compatible settings, including the IKE version and cryptographic profiles. This is why troubleshooting should compare both sides rather than inspecting only the firewall where an error is noticed. ### The other options - **False**: this would be correct only if one endpoint could establish a peer relationship without the other endpoint's compatible configuration. ### Terms - **IKE**: Internet Key Exchange. A protocol used to negotiate VPN settings. - **VPN**: Virtual Private Network. A protected connection between networks. ### Remember Check the two VPN endpoints as a matched pair.