Question

An engineer built a route-based IPsec VTI tunnel from a Cisco IOS XE router to an Azure VPN Gateway. The tunnel is up and eBGP with the Azure gateway is established. The on-premises router learns Azure VNet prefixes via BGP, but Azure workloads cannot reach the on-premises 10.20.0.0/16 subnet. On IOS XE, 'show ip bgp neighbors <azure-ip> advertised-routes' shows no prefix for 10.20.0.0/16, even though the route is present in the local RIB and BGP table. What is the MOST likely cause?

Accepted Answer

An outbound BGP route-map or prefix-list toward the Azure neighbor is filtering the 10.20.0.0/16 advertisement

Answer

The IPsec Phase 2 SA lifetime is mismatched, preventing prefix exchange in that direction

Answer

Azure VPN Gateway does not support advertising customer prefixes larger than /24

Answer

The tunnel interface MTU is too small, dropping the BGP UPDATE containing the prefix