Question

An engineer configures a Cisco IOS XE router as a route reflector for two internal iBGP peers (branch routers) while also maintaining an IPsec VTI eBGP session to an AWS Virtual Private Gateway. The AWS-learned VPC prefixes appear in the route reflector's BGP table as best paths, but the two iBGP branch peers install the AWS prefixes with an unreachable next hop and the routes fail to enter their RIB. The eBGP session to AWS is stable and the tunnel is up. What is the most likely cause?

Accepted Answer

The route reflector is advertising the AWS prefixes to iBGP peers without modifying the next hop, so the branches receive the AWS tunnel-endpoint next hop, which they cannot resolve

Answer

The AWS Virtual Private Gateway is prepending its ASN, causing the branches to reject the routes due to AS-path loop detection

Answer

Phase 2 PFS mismatch on the VTI is preventing prefix installation on the branch routers

Answer

The route reflector is missing the 'bgp additional-paths' command required to reflect eBGP-learned routes to iBGP clients