Question

An engineer manages an IPsec VTI tunnel between a Cisco IOS XE router and an AWS VGW. The AWS side advertises the VPC CIDR 10.20.0.0/16 to the router via BGP, and the router receives it correctly (visible in 'show ip bgp'). However, the route never appears in the IOS XE routing table, so on-premises hosts cannot reach the VPC. The tunnel is up, the BGP session is Established, and 'show ip bgp 10.20.0.0/16' shows the prefix marked with 'not advertised to any peer' and a status code of 'r RIB-failure'. What is the most likely cause?

Accepted Answer

A static route for 10.20.0.0/16 with a lower administrative distance already exists, preventing the BGP-learned route from being installed in the RIB

Answer

The IKEv2 Phase 2 lifetime is mismatched, causing the SA to expire before the route can be installed

Answer

The BGP neighbor is missing the 'next-hop-self' command, so the next hop is unreachable

Answer

AWS VGW only supports static routing, so BGP-learned prefixes are silently discarded