Question

An engineer connects an on-premises Cisco IOS XE router to a Cisco IOS XE router hosted in an AWS VPC using two parallel IPsec VTI tunnels for redundancy. Both tunnels run eBGP over the tunnel interfaces to the same remote AS. The engineer notices that only one tunnel carries traffic, even though both BGP sessions are established and advertising the same prefixes. Return traffic from AWS also uses only a single tunnel. The engineer wants both tunnels to actively share load for the cloud-destined prefixes. Which configuration change on the IOS XE routers achieves this?

Accepted Answer

Enable 'maximum-paths 2' under the BGP address family on both routers so equal-cost eBGP paths are installed and used simultaneously

Answer

Change both tunnels from VTI to crypto map based configuration so IPsec can hash traffic across the tunnels

Answer

Configure 'bgp bestpath as-path multipath-relax' only on the on-premises router to relax the path selection

Answer

Increase the BGP hold timer on the standby tunnel so both sessions remain equally preferred