A network engineer establishes an IPsec VTI (tunnel mode, IPv4) between an on-premises Cisco IOS XE router and a Cisco IOS XE router hosted in an AWS VPC. BGP over the tunnel comes up and routes are exchanged successfully. However, users report that SSH and ICMP work fine, but HTTPS sessions to cloud application servers frequently hang or time out on large downloads. The physical WAN interface uses the default 1500-byte MTU. Which configuration on the tunnel interface most directly resolves the issue?