Question

An engineer configures OSPF over an IPsec VTI between a Cisco IOS XE router and an Azure VNet appliance to exchange routes. Phase 1 and Phase 2 complete successfully, and pings across the tunnel succeed with small packets. However, the OSPF adjacency is stuck in EXSTART/EXCHANGE and never reaches FULL. Debugging shows the routers exchanging DBD packets repeatedly. What is the MOST likely root cause?

Accepted Answer

An MTU mismatch on the tunnel interfaces causes large DBD packets to be dropped, preventing the exchange from completing

Answer

The OSPF process IDs differ between the IOS XE router and the Azure appliance

Answer

IPsec Phase 2 PFS group is mismatched, silently dropping OSPF traffic

Answer

The OSPF area IDs match but authentication keys are absent, blocking hello packets