Question

A network engineer is building a GRE-over-IPsec tunnel from an on-premises Cisco IOS XE router to an Azure native VPN Gateway. Because the Azure VPN Gateway does not support GRE encapsulation, the engineer must terminate the design using a supported model while still reaching the 10.50.0.0/16 Azure VNet address space. The on-premises router uses a route-based configuration with a virtual tunnel interface (Tunnel1) and no dynamic routing protocol is permitted by policy. Which action correctly establishes reachability to the Azure VNet over this tunnel?

Accepted Answer

Configure Tunnel1 as an IPsec VTI (tunnel mode ipsec ipv4) and add a static route for 10.50.0.0/16 pointing to Tunnel1

Answer

Configure Tunnel1 with tunnel mode gre ip and a tunnel protection ipsec profile, then add a static route for 10.50.0.0/16 to Tunnel1

Answer

Configure a crypto map with a GRE ACL matching 10.50.0.0/16 and bind it to the physical interface

Answer

Enable BGP over the GRE tunnel to learn 10.50.0.0/16 dynamically from the Azure VPN Gateway