Question

A network engineer is building a GRE over IPsec tunnel from an on-premises Cisco IOS XE router to a Cisco IOS XE router hosted in AWS. Both sides use IKEv2 with pre-shared key authentication. The IKEv2 SA comes up intermittently and the logs on the on-premises router show 'IKEv2 profile not found' during some negotiations, even though a single IKEv2 profile is configured. The peer sits behind a NAT device, so the source address seen for its IKE negotiations does not match the address configured in the profile. What is the most likely configuration cause and the correct fix?

Accepted Answer

The IKEv2 profile 'match identity remote address' statement uses the peer's private IP; change it to match the remote IKE identity by FQDN/key-id or use 'match identity remote any' so the profile is selected regardless of the NAT-translated source address

Answer

The tunnel is missing 'tunnel mode ipsec ipv4'; add it to force IPsec transport so the profile can be applied

Answer

The crypto IKEv2 proposal lists an unsupported DH group; remove group 14 and use group 2 to match AWS defaults

Answer

NAT traversal is disabled; enter 'crypto ipsec nat-transparency udp-encapsulation' to allow the profile to load