Question

A network engineer is connecting an on-premises Cisco IOS XE router to a native AWS Site-to-Site VPN using two IPsec tunnels terminated on an AWS Virtual Private Gateway. During configuration, the engineer must specify the transform set and IPsec mode required for the tunnel to establish successfully with the AWS native endpoint (which does not support GRE encapsulation). Which IPsec configuration element must be used on the IOS XE Virtual Tunnel Interface (VTI) to match the AWS native VPN endpoint?

Accepted Answer

An IPsec profile referencing a transform set configured with 'mode tunnel', applied to an IPsec VTI (tunnel mode ipsec ipv4)

Answer

A crypto map with 'mode transport' bound to the physical WAN interface

Answer

An IPsec profile with a transform set using 'mode transport', applied to a GRE tunnel interface (tunnel mode gre ip)

Answer

An IKEv1 crypto map using AH transform with 'mode tunnel' applied to the loopback interface