Question

You are configuring a route-based IPsec VPN from an on-premises Cisco IOS XE router to a native Azure VPN Gateway (VpnGw2, Generation2). Azure will terminate the tunnel using IKEv2. To ensure Phase 2 (IPsec SA / child SA) negotiation succeeds with Azure's default supported parameters while maximizing hardware-accelerated throughput, which IPsec transform set should you configure on the IOS XE router?

Accepted Answer

crypto ipsec transform-set AZURE-TS esp-gcm 256, with mode tunnel

Answer

crypto ipsec transform-set AZURE-TS esp-des esp-md5-hmac, with mode tunnel

Answer

crypto ipsec transform-set AZURE-TS esp-3des esp-sha-hmac, with mode transport

Answer

crypto ipsec transform-set AZURE-TS ah-sha256-hmac, with mode tunnel