Question

A network engineer configures a route-based IPsec VTI tunnel between an on-premises Cisco IOS XE router and a cloud-hosted Cisco IOS XE router (Catalyst 8000V) in AWS. OSPF is enabled on both Tunnel0 interfaces to exchange routes. The IPsec tunnel is up and both routers can ping each other's tunnel IP addresses, but the OSPF adjacency remains stuck in the EXSTART/EXCHANGE state and never reaches FULL. What is the most likely cause?

Accepted Answer

An MTU mismatch on the tunnel interfaces prevents the exchange of large OSPF Database Description packets

Answer

The IKEv2 proposal encryption algorithms do not match between the two peers

Answer

The BGP AS numbers are misconfigured, blocking OSPF from forming an adjacency

Answer

The tunnel is configured in GRE mode instead of IPsec transport mode