Which option is a possible cause of this failure?

Q71.You are troubleshooting a FlexVPN deployment. You find that while the tunnel from the spokes to the hubs are in the “UP” state, communication is still broken. Upon further investigation, you determine that ICMP echo that is initiated from an endpoint in the spoke site is seen by the destination endpoint in the hub site, Which sends an ICMP reply back, but this reply is not received on endpoint A. Your FlexVPN hub and spoke are behind a NAT device.

Which option is a possible cause of this failure?

A. UDP 500 is blocked outbound from the hub or inbound on the spoke

B. UDP 4500 is blocked outbound from the hub or inbound on the spoke

C. FlexVPN doesn’t work with NAT

D. FlexVPN doesn’t work with NAT

E. ESP is blocked outbound from the hub or inbound on the spoke

Answer: B