Question

An engineer configured a route-based IPsec VTI tunnel from an on-premises Cisco IOS XE router to an AWS VPN gateway. IKEv2 Phase 1 completes successfully and the SA is established, but no Phase 2 IPsec SA forms and 'show crypto ipsec sa' shows zero encrypted/decrypted packets. Debug output on the router shows 'ts_unacceptable' notifications received from AWS. What is the most likely cause?

Accepted Answer

The router's IPsec profile applies a crypto ACL with specific proxy IDs instead of the any/any (0.0.0.0/0) traffic selectors that AWS route-based VPN expects

Answer

The IKEv2 proposal on the router uses a different DH group than the AWS-side policy

Answer

The tunnel interface MTU is set too high, causing fragmentation of the Phase 2 negotiation packets

Answer

BGP has not yet converged, so the router has no routes to send into the tunnel