Question

An engineer connects an on-premises Cisco IOS XE router to a Cisco IOS XE router hosted in Azure over an IPsec VPN using a route-based (VTI) tunnel. The on-premises site runs OSPF internally, while eBGP is used across the IPsec tunnel to the cloud router to exchange prefixes. The engineer redistributes BGP-learned cloud prefixes into the on-premises OSPF process. After the change, internal OSPF routers receive the cloud prefixes but users report that traffic to the cloud is intermittently blackholed when a second, less-preferred WAN path also injects the same prefixes. What is the most effective way to ensure the OSPF-redistributed cloud routes are correctly and consistently preferred?

Accepted Answer

Redistribute the BGP routes into OSPF as external type 1 (E1) with a route-map that tags them, and filter/adjust metrics on the redundant path so the intended tunnel path wins on cumulative cost

Answer

Change the eBGP session to iBGP so the cloud prefixes carry an unchanged AS_PATH into the OSPF domain

Answer

Redistribute the routes as OSPF external type 2 (E2) with the default metric on both WAN paths so OSPF always load-balances between them

Answer

Disable OSPF entirely on the tunnel-facing router and rely on static default routes pointing at the IPsec VTI interface