Question

An engineer configures an IPsec VTI from a Cisco IOS XE router to a Google Cloud HA VPN gateway. The IPsec tunnel establishes successfully and both tunnel interfaces show line protocol up, but the eBGP session to the Cloud Router's BGP peer IP (169.254.x.x) remains stuck in the Idle/Active state. The Cloud Router is configured with Google ASN 64512 and expects the on-premises peer ASN 65001. On the IOS XE router the neighbor is defined under 'router bgp 65010'. What is the most likely cause?

Accepted Answer

The local BGP ASN on the IOS XE router (65010) does not match the peer ASN (65001) configured on the Google Cloud Router, so the OPEN message is rejected

Answer

The IPsec Phase 2 PFS group is mismatched, preventing BGP TCP packets from traversing the tunnel

Answer

The tunnel MTU is too high, causing BGP OPEN messages to be fragmented and dropped

Answer

The Cloud Router requires MD5 authentication that is not enabled on the IOS XE neighbor statement