Question

An engineer connects an on-premises Cisco IOS XE router to an Azure VNet using two IPsec VTI tunnels to a route-based Azure VPN Gateway, both running BGP. Azure is advertising the same VNet prefix (10.50.0.0/16) over both tunnels, and the on-premises router is load-sharing return traffic across both. The requirement is that Tunnel1 be the primary path for all traffic destined to Azure, with Tunnel2 used only if Tunnel1 fails. Which action on the Cisco IOS XE router achieves deterministic primary/backup path selection for traffic sent TO Azure?

Accepted Answer

Apply an inbound route-map on the Tunnel2 BGP neighbor that sets a lower local-preference for the 10.50.0.0/16 prefix learned over Tunnel2

Answer

Apply an outbound route-map toward the Tunnel2 neighbor that adds AS-path prepends to the advertised on-premises prefixes

Answer

Configure MED (metric) higher on the routes advertised outbound over Tunnel1 to Azure

Answer

Enable BGP multipath so both tunnels are installed and let ECMP hashing prefer Tunnel1