message 1 and 2

message 3 and 4

message 5 and 6

message 7 and 8

Telnet is not being permitted by self policy.

Telnet is not being permitted by security policy.

Telnet is not allowed because it is not considered secure.

Telnet is not enabled as a host-inbound service on the zone

syn-fin， syn-flood， and tcp-no-frag

syn-fin， port-scan， and tcp-no-flag

syn-fin， fin-no-ack， and tcp-no-frag

syn-fin， syn-ack-ack-proxy， and tcp-no-frag

You cannot assign an interface to a functional zone.

You can specifiy a functional zone in a security policy.

Security zones must have a scheduler applied.

You can use a security zone for traffic destined for the device itself.

A

B

C

D

when one of the tunnel peers has a dynamic IP address

when one of the tunnel peers wants to force main mode to be used

when fragmentation of the IKE packet is required between the two peers

when one of the tunnel peers wants to specify a different phase 1 proposal

when the remote VPN peer is behind a NAT device

when multiple networks need to be reached across the tunnel and GRE cannot be used

when the remote VPN peer is a dialup or remote access client

when a dynamic routing protocol is required across the VPN and GRE cannot be used

Source NAT works only with source pools.

Destination NAT is required to translate the reply traffic.

Source NAT does not require a security policy to function.

The egress interface IP address can be used for source NAT