Question

A network engineer is designing GRE-over-IPsec connectivity from an on-premises Cisco IOS XE router to a native Azure VPN Gateway (not a cloud-hosted IOS XE instance). The design requires a routed tunnel interface running BGP over the encrypted overlay. During testing, IKEv2 and IPsec SAs come up successfully, but the GRE tunnel interface never reaches the up/up state and no BGP session forms. What is the most likely root cause of this failure?

Accepted Answer

The native Azure VPN Gateway does not support GRE encapsulation; it terminates route-based IPsec using VTI, so GRE-over-IPsec cannot be used and a plain IPsec VTI tunnel must be configured instead

Answer

The IKEv2 proposal on the IOS XE router is missing the GRE transform, which prevents the tunnel keepalives from being encrypted

Answer

BGP must be configured before the GRE tunnel interface is created, otherwise the tunnel remains administratively down

Answer

The Azure VPN Gateway requires the GRE tunnel key to match the IPsec pre-shared key for the tunnel to establish