When configuring an Internet Key Exchange (IKE) Phase 1 gateway for a site-to-site IPsec VPN between two firewalls with static IP addresses, which of the following is required to identify the remote VPN endpoint? (Select all that apply.)

### Why this is right The lab specifies IKEv2 only, `ethernet1/1` with its assigned local address, the remote firewall's Internet interface address as the peer address, and the pre-shared key `Secret5512`. These settings allow each firewall to identify the local endpoint, locate its partner, and authenticate the negotiation. ### The concept A peer address is the address at the other end of the connection, not the remote workstation's private address. The local interface must be the interface through which the firewalls communicate. A pre-shared key is a secret configured at both ends; it must match, and the lab requires it to remain masked in submitted screenshots. ### The other options - **D. The internal workstation address as the peer address**: a workstation is an endpoint behind the firewall, not the remote VPN gateway. This is tempting because workstations generate the traffic later carried by the tunnel. ### Terms - **IKE**: Internet Key Exchange. Negotiates VPN security associations. - **IP**: Internet Protocol. Provides network addressing. ### Watch out Do not confuse the VPN peer's public-facing firewall address with the private address of a host behind that firewall. ### Remember The IKE peer address is the remote firewall's Internet-facing address.