Question

A network engineer is establishing a site-to-site VPN from an on-premises Cisco IOS XE router to a native AWS Virtual Private Gateway (VGW). AWS has generated a configuration file specifying two tunnels, each with a pre-shared key and an inside tunnel address in the 169.254.0.0/16 range. The engineer wants dynamic route exchange over the tunnels using BGP. When configuring the IOS XE tunnel interfaces to match the AWS native endpoint, which combination correctly reflects how the tunnel must be built?

Accepted Answer

Use an IPsec VTI (tunnel mode ipsec ipv4) with the 169.254.x.x inside address and eBGP peering to the AWS-assigned APIPA neighbor

Answer

Use a GRE tunnel (tunnel mode gre ip) protected by an IPsec profile, and assign a public IP as the tunnel source

Answer

Use a crypto map applied to the physical WAN interface with no tunnel interface, and configure static routes to the VPC CIDR

Answer

Use a GRE tunnel with OSPF area 0 across the 169.254.x.x link because AWS VGW only supports OSPF for dynamic routing