Question

An engineer maintains an IPsec VTI tunnel from a Cisco IOS XE router to an Azure VPN gateway with eBGP over the tunnel. During brief, sub-second control-plane restarts on the IOS XE router (SSO switchovers on a dual-RP chassis), branch users report short traffic drops even though the tunnel interface never goes down. The Azure gateway supports BGP graceful restart. What should the engineer verify or configure on the IOS XE router to preserve forwarding across these restarts?

Accepted Answer

Enable BGP graceful restart (bgp graceful-restart) under the router bgp process so forwarding continues using stale routes while the BGP session re-establishes

Answer

Lower the BGP keepalive and hold timers to 3 and 9 seconds so the session detects and reconverges faster during the switchover

Answer

Configure BFD on the tunnel to trigger immediate route withdrawal when the RP switches over

Answer

Increase the IPsec SA lifetime so the tunnel does not rekey during the control-plane restart