Question

An engineer manages a site-to-site IPsec VTI tunnel between an on-premises Cisco IOS XE router and an AWS VPN gateway. The tunnel comes up successfully and passes traffic, but every hour users report a brief loss of connectivity to VPC-hosted applications. 'show crypto ipsec sa' on the IOS XE router shows the SA being torn down and rebuilt at regular intervals with a momentary gap before traffic resumes. Phase 1 stays up throughout. Which action most directly resolves the periodic drop?

Accepted Answer

Align the IPsec (Phase 2) SA lifetime on the IOS XE router with the AWS default and ensure the rekey occurs before expiry rather than on hard timeout

Answer

Increase the IKEv2 dead peer detection (DPD) interval on the IOS XE router to prevent premature Phase 1 teardown

Answer

Change the tunnel interface MTU to 1400 and enable TCP MSS clamping to 1360 on the IOS XE router

Answer

Enable perfect forward secrecy (PFS) with DH group 14 in the IPsec transform set to speed up SA negotiation