Question

A network engineer is configuring a Secure Internet Gateway (SIG) IPsec tunnel from a Cisco Catalyst SD-WAN branch WAN Edge to a cloud-delivered security service. The branch has a single internet transport (biz-internet) whose IP address is dynamically assigned by the ISP and translated behind a service-provider CGNAT. During validation, the SIG tunnel repeatedly fails to establish IKEv2 SAs even though the underlay reaches the SIG endpoint. What is the most likely cause the engineer must address in the SIG feature template?

Accepted Answer

The tunnel must use the TLOC (transport) interface as its source, and NAT-Traversal (UDP 4500 encapsulation) must be enabled so IKEv2 succeeds through the CGNAT

Answer

The SIG tunnel source must be changed to a service-side VPN loopback so the private address is advertised to the SIG headend

Answer

A static public IP must be requested from the ISP because SIG tunnels cannot be built over dynamically addressed transports

Answer

OMP must redistribute the biz-internet TLOC into the SIG service VPN before the IKEv2 negotiation can complete