Question

An engineer manages a route-based IPsec VTI tunnel from an on-premises Cisco IOS XE router to an Azure VPN Gateway. The tunnel came up successfully, but after several hours users report intermittent loss of connectivity to Azure workloads. On the IOS XE router, 'show crypto ikev2 sa' shows the SA state flapping between READY and DELETING, and the logs contain repeated 'IKEv2-ERROR: Received INVALID_SPI notify' messages. Ping traffic recovers only after a manual 'clear crypto ikev2 sa'. What is the MOST likely cause of this behavior?

Accepted Answer

Dead Peer Detection (DPD) is disabled on the IOS XE router, so it cannot detect and rebuild the stale SA after the Azure gateway performs a maintenance-driven rekey

Answer

The IKEv2 proposal on IOS XE offers only DH group 2, which Azure rejects during the initial exchange

Answer

The BGP hold timer is shorter than the IKEv2 SA lifetime, causing the routing session to drop before Phase 2 rekeys

Answer

The tunnel MTU is set too high, causing large packets to be fragmented and dropped by Azure