Question

A network engineer establishes a route-based IPsec VPN using a Virtual Tunnel Interface (VTI) from an on-premises Cisco IOS XE router to a Google Cloud HA VPN gateway. BGP is configured across the tunnel to exchange routes with the GCP Cloud Router (ASN 65001; on-prem ASN 65500). After the IKEv2 SA and tunnel come up, the interface shows 'up/up', but the BGP session repeatedly cycles between Idle and Active and never reaches Established. Manual pings to the Cloud Router's BGP peer IP succeed. What is the MOST likely cause?

Accepted Answer

The BGP neighbor is configured against the Cloud Router's public gateway IP instead of the link-local /30 APIPA (169.254.x.x) peer address assigned by GCP

Answer

The tunnel MTU is set too high, causing IKEv2 rekey failures that reset the BGP session

Answer

GCP Cloud Router requires OSPF over the VPN tunnel and does not support BGP peering on HA VPN

Answer

The on-premises router must advertise a default route via a static route because Cloud Router rejects dynamic BGP prefixes