Question

A network engineer is deploying a route-based IPsec VPN from an on-premises Cisco IOS XE router to a cloud-hosted Cisco IOS XE router (Cisc router in a VPC). The on-premises router has two physical internet-facing interfaces (GigabitEthernet0/0/0 and GigabitEthernet0/0/1) connected to two different ISPs for redundancy. The engineer wants a single stable IKEv2/IPsec tunnel identity that can survive the failure of either uplink without re-establishing the security association. What is the recommended way to configure the tunnel source on the on-premises router?

Accepted Answer

Configure a Loopback interface with a routable/NAT-mapped address, set 'tunnel source LoopbackX' on the VTI, and use IP SLA-tracked static routes so either ISP can reach the loopback.

Answer

Set 'tunnel source GigabitEthernet0/0/0' and add a floating static default route through GigabitEthernet0/0/1 as a backup.

Answer

Configure two separate tunnel interfaces, one sourced from each physical interface, and let the cloud router pick whichever SA arrives first.

Answer

Use 'tunnel source dynamic' on the VTI so IOS XE automatically rebinds the tunnel to whichever interface currently has a default route.