To establish IPsec site-to-site connections, which is essential for SA establishment?

• A. Shared secret or digital certificates for SA establishment
• B. Web server certificate
• C. VPN client application
• D. Firewall rule only

Answer: (A)

IPsec site-to-site connections rely on mutual authentication during the IKE phase to establish the Security Association. The essential ingredient for this authentication is credentials exchanged between gateways, typically a pre-shared key (shared secret) or digital certificates issued by a trusted PKI. With valid credentials, the gateways can authenticate each other and derive shared keys to protect subsequent IPsec negotiations. Web server certificates are used for TLS/HTTPS rather than IPsec. A VPN client application is used for remote access by end users, not gateway-to-gateway site-to-site. A firewall rule alone can control traffic but does not perform the authentication or key exchange needed to establish SAs.