Question

An engineer runs two IPsec VTI tunnels from an on-premises Cisco IOS XE router to a Google Cloud HA VPN gateway, with BGP over each tunnel to a Cloud Router. To provide a backup path, the same on-prem prefixes are also learned via OSPF from a second data center and redistributed into BGP. After the change, the Cloud Router intermittently withdraws several on-prem prefixes and the engineer sees those prefixes flapping in 'show ip bgp' on the IOS XE router. Route tables on-prem look correct. What is the MOST likely root cause of the flapping advertisements to GCP?

Accepted Answer

The redistributed OSPF routes are being advertised into BGP without route tagging, and the same prefixes re-enter via the second path, causing a redistribution feedback loop that destabilizes the BGP advertisements to the Cloud Router

Answer

The GCP Cloud Router does not support receiving more than one BGP prefix per HA VPN tunnel, forcing it to withdraw duplicates

Answer

IKEv2 rekey timers on the two tunnels are mismatched, tearing down BGP sessions periodically

Answer

The tunnel MTU is set too high, dropping large BGP update packets and causing prefix withdrawals