Question

An engineer has established an IPsec VTI tunnel from an on-premises Cisco IOS XE router to an Azure VPN Gateway configured for BGP. The BGP session over the tunnel comes up successfully and the router learns the Azure VNet prefix 10.20.0.0/16. However, Azure never learns the on-premises prefix 192.168.50.0/24, and no traffic can reach on-premises resources from the VNet. The on-premises subnet is directly connected to a LAN interface and BGP is otherwise configured correctly. What is the most likely cause?

Accepted Answer

The router is missing a 'network 192.168.50.0 mask 255.255.255.0' statement (or redistribution) under the BGP process, so the prefix is never advertised to Azure.

Answer

Azure VPN Gateway does not support receiving /24 prefixes over BGP and requires prefix aggregation to /16.

Answer

The tunnel MTU is too small, preventing BGP UPDATE messages carrying the prefix from being transmitted.

Answer

The IKEv2 proposal must include the on-premises subnet in the crypto ACL for the route to be advertised via BGP.