Question

A network engineer is building a GRE over IPsec tunnel from an on-premises Cisco IOS XE router to a cloud-hosted Cisco IOS XE router in AWS to run eBGP across the overlay. After configuring the IPsec profile, tunnel interface, and BGP peering over the tunnel IP addresses, the IPsec SA comes up and the BGP session reaches Established, but it repeatedly resets once the peers exchange their full routing tables, and large file transfers across the tunnel stall. The tunnel source is a public interface behind a 1500-byte MTU internet path. What is the MOST likely cause and the correct remediation?

Accepted Answer

The tunnel keepalives and BGP packets are being dropped due to fragmentation; lower the tunnel IP MTU and set 'ip tcp adjust-mss' on the tunnel interface to account for GRE and IPsec overhead

Answer

The IPsec profile is applied in tunnel mode; change it to transport mode so BGP multicast hellos can traverse the tunnel

Answer

eBGP is unsupported over GRE/IPsec overlays to cloud endpoints; replace BGP with a static default route pointing at the tunnel interface

Answer

The tunnel keepalive interval is too long; disable GRE keepalives entirely so the line protocol stops flapping