Question

A network engineer has deployed Cisco Catalyst SD-WAN Cloud OnRamp for Multicloud with a cloud gateway in an AWS host VPC. The IPsec tunnels between the branch edge routers and the cloud gateway show as up, but the branch VPNs cannot reach workloads in the spoke VPCs. On the cloud gateway, 'show sdwan omp routes' displays the branch prefixes, but 'show ip route vrf 1' on the AWS spoke workload path shows no routes from the branch. The Transit Gateway route tables and TGW-to-VPC attachments are confirmed correct. What is the MOST likely cause of the reachability failure?

Accepted Answer

The service-side VPN (VRF) segment mapping between the cloud gateway and the spoke VPCs is missing or misconfigured, so branch OMP routes are not being advertised into the TGW/VPC route domain

Answer

The IKEv2 proposal on the branch routers uses AES-GCM while the cloud gateway expects AES-CBC, preventing Phase 2 SA establishment

Answer

The branch routers are missing an ebgp-multihop statement, causing the BGP session to the Cloud Router to remain idle

Answer

The DF bit is set on the tunnel interface, causing fragmentation drops of the workload traffic