Question

An engineer manages an IPsec VTI tunnel from a Cisco IOS XE router to an AWS VPN gateway with eBGP over the tunnel. The tunnel interface is stable, but the AWS-learned prefixes for a specific VPC (10.50.0.0/16) intermittently disappear from the IOS XE routing table for several minutes at a time, then reappear. Other prefixes learned over the same BGP session remain stable throughout. 'show ip bgp 10.50.0.0/16' during the outage shows the path exists but is marked as 'dampened' with an accumulated penalty. What is the most likely cause?

Accepted Answer

BGP route dampening is configured on the IOS XE router, and the flapping upstream prefix accumulated enough penalty to be suppressed until its penalty decayed below the reuse limit

Answer

The IKEv2 SA for that traffic selector is rekeying and dropping the specific prefix during Phase 2 negotiation

Answer

AWS is applying inbound AS-path prepending only to the 10.50.0.0/16 prefix, causing it to lose the best-path selection intermittently

Answer

The tunnel MTU is too small for the larger BGP update carrying 10.50.0.0/16, causing that update to be dropped repeatedly