Question

An engineer diagnoses a route-based IPsec VTI tunnel between an on-premises Cisco IOS XE router and an AWS Virtual Private Gateway (VGW). The tunnel is up and the BGP session with AWS reaches the Established state, but the router logs show '%BGP-5-NBRSTATE: neighbor 169.254.10.1 Up' followed minutes later by repeated '%BGP-4-MAXPFX: No. of prefix received from 169.254.10.1 reached 100, max 100' messages, and the neighbor then transitions to Idle (PfxCt). On-premises reachability to VPC subnets breaks each time this occurs. What is the MOST likely cause?

Accepted Answer

The router's 'maximum-prefix' limit configured under the BGP neighbor is set too low for the number of routes AWS advertises, so BGP tears down the session when the limit is exceeded

Answer

The IKEv2 rekey lifetime on the IOS XE side is shorter than the AWS side, causing the tunnel to renegotiate and drop the BGP session

Answer

The AWS VGW is sending routes with an AS-path loop that the IOS XE router rejects, preventing prefix installation

Answer

BGP keepalive and hold timers are mismatched, causing the neighbor to time out after establishing