Question

An engineer terminates an IPsec VTI tunnel from a Cisco IOS XE router to a Google Cloud instance running FRR (Quagga) with OSPF as the routing protocol over the tunnel. The IPsec SA is up and both sides can ping each other's tunnel IP. However, the OSPF neighbor relationship never advances past EXSTART/EXCHANGE and repeatedly resets. The tunnel interface MTU on the IOS XE side shows 1400, while the FRR peer advertises an interface MTU of 1500 in its DBD packets. What is the most likely cause and correct remediation?

Accepted Answer

The OSPF interface MTU values differ between the two neighbors; set matching MTU on the tunnel or configure 'ip ospf mtu-ignore' on the IOS XE tunnel interface

Answer

The OSPF network types are mismatched; change the IOS XE tunnel to 'ip ospf network broadcast' to elect a DR/BDR

Answer

The OSPF hello and dead intervals do not match; align the timers on both ends to allow the adjacency to progress

Answer

IPsec is fragmenting the DBD packets; disable PFS on the crypto profile so the larger DBD packets can traverse the tunnel