Question

An engineer troubleshoots a route-based IPsec tunnel from a Cisco IOS XE router to a native Azure VPN gateway. The IOS XE router sits behind a corporate firewall that performs PAT (NAT overload) on its public interface. IKEv2 negotiation begins but never completes; 'show crypto ikev2 sa' shows the SA stuck in the IN-NEG state, and debugs show the Azure gateway is not authenticating the peer. The pre-shared keys, transform sets, and DH groups all match. What is the MOST likely cause?

Accepted Answer

IKEv2 is authenticating with the router's private IP as the IKE identity, which does not match the peer address Azure expects; the identity must be set to the public FQDN or address

Answer

The tunnel MTU is too large, causing the IKE_AUTH packet to fragment and be dropped by the firewall

Answer

Azure only supports policy-based (crypto map) VPNs, so the route-based VTI configuration is invalid

Answer

BGP has not established over the tunnel, which prevents Phase 1 from completing