Question

An engineer runs OSPF over an IPsec VTI (Tunnel10) between an on-premises Cisco IOS XE router and an Azure-hosted IOS XE NVA. IKEv2 and IPsec Phase 2 are up, and the tunnel interface shows line protocol up/up with correct IP addressing on the /30. However, the OSPF neighbor stays stuck in EXSTART/EXCHANGE and never reaches FULL. Debug shows the routers repeatedly retransmitting DBD packets. What is the MOST likely cause?

Accepted Answer

There is an MTU mismatch on the tunnel interfaces, so large DBD packets are dropped

Answer

The OSPF process IDs differ between the two routers, preventing adjacency formation

Answer

The OSPF network type is set to point-to-point on one side and broadcast on the other

Answer

The IPsec transform set uses AES-GCM, which is incompatible with OSPF over a VTI