Question

A network engineer is building a GRE-over-IPsec design from an on-premises Cisco IOS XE router to a native Google Cloud HA VPN gateway. The requirement is that the connection provide a 99.99% availability SLA from Google. During design review, a colleague proposes terminating a single IPsec tunnel from the IOS XE router to one HA VPN gateway interface. What must the engineer do instead to meet the SLA requirement?

Accepted Answer

Configure two IPsec tunnels from the IOS XE router, one to each of the HA VPN gateway's two interfaces (each with its own external IP), and advertise routes over both with BGP.

Answer

Configure a single IPsec tunnel but enable Dead Peer Detection (DPD) with aggressive timers so the tunnel re-establishes quickly after a failure.

Answer

Terminate the single tunnel on a Google Cloud Classic VPN gateway instead, since Classic VPN provides the 99.99% SLA for single-tunnel designs.

Answer

Deploy two separate on-premises IOS XE routers, each with one tunnel to the same single HA VPN gateway interface.