Operation

An engineer troubleshoots a route-based IPsec tunnel from a Cisco IOS XE router to a native Azure VPN gateway. The IOS XE router sits behind a corporate firewall that performs PAT (NAT overload) on its public interface. IKEv2 negotiation begins but never completes; 'show crypto ikev2 sa' shows the SA stuck in the IN-NEG state, and debugs show the Azure gateway is not authenticating the peer. The pre-shared keys, transform sets, and DH groups all match. What is the MOST likely cause?

An engineer configures a redundant design where an on-premises Cisco IOS XE router forms IPsec VTI tunnels to two AWS VGWs in separate regions. Both regions are interconnected, and AWS re-advertises the on-premises prefixes learned from one region toward the other. The IOS XE router logs no errors, tunnels are up, and BGP is established on both tunnels, but the router refuses to install the prefixes AWS advertises from the second region. 'show ip bgp' shows those prefixes received but with the reason 'received-only'. What is the most likely cause?

An engineer manages an IPsec VTI tunnel between a Cisco IOS XE router and an AWS VGW. The AWS side advertises the VPC CIDR 10.20.0.0/16 to the router via BGP, and the router receives it correctly (visible in 'show ip bgp'). However, the route never appears in the IOS XE routing table, so on-premises hosts cannot reach the VPC. The tunnel is up, the BGP session is Established, and 'show ip bgp 10.20.0.0/16' shows the prefix marked with 'not advertised to any peer' and a status code of 'r RIB-failure'. What is the most likely cause?

An engineer diagnoses a route-based IPsec VTI tunnel between an on-premises Cisco IOS XE router and an AWS Virtual Private Gateway (VGW). The tunnel is up and the BGP session with AWS reaches the Established state, but the router logs show '%BGP-5-NBRSTATE: neighbor 169.254.10.1 Up' followed minutes later by repeated '%BGP-4-MAXPFX: No. of prefix received from 169.254.10.1 reached 100, max 100' messages, and the neighbor then transitions to Idle (PfxCt). On-premises reachability to VPC subnets breaks each time this occurs. What is the MOST likely cause?

An engineer configures a Cisco IOS XE router as a route reflector for two internal iBGP peers (branch routers) while also maintaining an IPsec VTI eBGP session to an AWS Virtual Private Gateway. The AWS-learned VPC prefixes appear in the route reflector's BGP table as best paths, but the two iBGP branch peers install the AWS prefixes with an unreachable next hop and the routes fail to enter their RIB. The eBGP session to AWS is stable and the tunnel is up. What is the most likely cause?

An engineer configured a redundant IPsec VTI design between a Cisco IOS XE router and two AWS VPN tunnels toward a Transit Gateway. eBGP sessions to both AWS tunnel inside addresses come up and routes are learned. However, traffic destined to the VPC subnets is intermittently blackholed. On IOS XE, 'show ip route' shows the VPC prefixes as BGP routes whose next-hop is the AWS tunnel inside IP, but that next-hop is resolved via the default route pointing to the physical internet interface rather than the tunnel interface. What is the most likely cause of the blackholing?

An engineer manages an IPsec VTI tunnel from a Cisco IOS XE router to an AWS VPN gateway with eBGP over the tunnel. The tunnel interface is stable, but the AWS-learned prefixes for a specific VPC (10.50.0.0/16) intermittently disappear from the IOS XE routing table for several minutes at a time, then reappear. Other prefixes learned over the same BGP session remain stable throughout. 'show ip bgp 10.50.0.0/16' during the outage shows the path exists but is marked as 'dampened' with an accumulated penalty. What is the most likely cause?

An engineer manages a site-to-site IPsec VTI tunnel between an on-premises Cisco IOS XE router and an AWS VPN gateway. The tunnel comes up successfully and passes traffic, but every hour users report a brief loss of connectivity to VPC-hosted applications. 'show crypto ipsec sa' on the IOS XE router shows the SA being torn down and rebuilt at regular intervals with a momentary gap before traffic resumes. Phase 1 stays up throughout. Which action most directly resolves the periodic drop?

An engineer configured a route-based IPsec VTI tunnel from an on-premises Cisco IOS XE router to an AWS VPN gateway. IKEv2 Phase 1 completes successfully and the SA is established, but no Phase 2 IPsec SA forms and 'show crypto ipsec sa' shows zero encrypted/decrypted packets. Debug output on the router shows 'ts_unacceptable' notifications received from AWS. What is the most likely cause?

An engineer configures two IPsec VTI tunnels from a Cisco IOS XE router to an Azure VPN gateway that operates in active-active mode. Both eBGP sessions to the Azure gateway instances are established, and both are receiving the same Azure VNet prefix (10.20.0.0/16). However, 'show ip route 10.20.0.0' displays only a single next hop, and traffic is not load-sharing across both tunnels. IPsec and BGP are otherwise healthy. Which configuration change on the IOS XE router will enable traffic to use both tunnels?

An engineer maintains an IPsec VTI tunnel from a Cisco IOS XE router to an Azure VPN gateway with eBGP over the tunnel. During brief, sub-second control-plane restarts on the IOS XE router (SSO switchovers on a dual-RP chassis), branch users report short traffic drops even though the tunnel interface never goes down. The Azure gateway supports BGP graceful restart. What should the engineer verify or configure on the IOS XE router to preserve forwarding across these restarts?

An engineer built a route-based IPsec VTI tunnel from a Cisco IOS XE router to an Azure VPN Gateway. The tunnel is up and eBGP with the Azure gateway is established. The on-premises router learns Azure VNet prefixes via BGP, but Azure workloads cannot reach the on-premises 10.20.0.0/16 subnet. On IOS XE, 'show ip bgp neighbors <azure-ip> advertised-routes' shows no prefix for 10.20.0.0/16, even though the route is present in the local RIB and BGP table. What is the MOST likely cause?

An engineer manages a route-based IPsec VTI tunnel from an on-premises Cisco IOS XE router to an Azure VPN Gateway. The tunnel came up successfully, but after several hours users report intermittent loss of connectivity to Azure workloads. On the IOS XE router, 'show crypto ikev2 sa' shows the SA state flapping between READY and DELETING, and the logs contain repeated 'IKEv2-ERROR: Received INVALID_SPI notify' messages. Ping traffic recovers only after a manual 'clear crypto ikev2 sa'. What is the MOST likely cause of this behavior?

An engineer configures OSPF over an IPsec VTI between a Cisco IOS XE router and an Azure VNet appliance to exchange routes. Phase 1 and Phase 2 complete successfully, and pings across the tunnel succeed with small packets. However, the OSPF adjacency is stuck in EXSTART/EXCHANGE and never reaches FULL. Debugging shows the routers exchanging DBD packets repeatedly. What is the MOST likely root cause?

An engineer runs OSPF over an IPsec VTI (Tunnel10) between an on-premises Cisco IOS XE router and an Azure-hosted IOS XE NVA. IKEv2 and IPsec Phase 2 are up, and the tunnel interface shows line protocol up/up with correct IP addressing on the /30. However, the OSPF neighbor stays stuck in EXSTART/EXCHANGE and never reaches FULL. Debug shows the routers repeatedly retransmitting DBD packets. What is the MOST likely cause?

An engineer configures an IPsec VTI from a Cisco IOS XE router to a Google Cloud HA VPN gateway. The IPsec tunnel establishes successfully and both tunnel interfaces show line protocol up, but the eBGP session to the Cloud Router's BGP peer IP (169.254.x.x) remains stuck in the Idle/Active state. The Cloud Router is configured with Google ASN 64512 and expects the on-premises peer ASN 65001. On the IOS XE router the neighbor is defined under 'router bgp 65010'. What is the most likely cause?

An engineer runs two IPsec VTI tunnels from an on-premises Cisco IOS XE router to a Google Cloud HA VPN gateway, with BGP over each tunnel to a Cloud Router. To provide a backup path, the same on-prem prefixes are also learned via OSPF from a second data center and redistributed into BGP. After the change, the Cloud Router intermittently withdraws several on-prem prefixes and the engineer sees those prefixes flapping in 'show ip bgp' on the IOS XE router. Route tables on-prem look correct. What is the MOST likely root cause of the flapping advertisements to GCP?

An engineer terminates an IPsec VTI tunnel from a Cisco IOS XE router to a Google Cloud instance running FRR (Quagga) with OSPF as the routing protocol over the tunnel. The IPsec SA is up and both sides can ping each other's tunnel IP. However, the OSPF neighbor relationship never advances past EXSTART/EXCHANGE and repeatedly resets. The tunnel interface MTU on the IOS XE side shows 1400, while the FRR peer advertises an interface MTU of 1500 in its DBD packets. What is the most likely cause and correct remediation?

An engineer connects an on-premises Cisco IOS XE router to a Cisco Catalyst 8000V deployed inside a Google Cloud VPC over an IPsec VTI and runs OSPF across the tunnel to exchange routes with that cloud-hosted router. The IPsec SA is up and the tunnel interface passes ICMP, but no OSPF adjacency forms and 'show ip ospf neighbor' is empty. The engineer confirms both sides use OSPF area 0, matching timers, and the same network type. Reviewing the IOS XE configuration reveals 'passive-interface Tunnel1' is present under the OSPF process. What is the most likely cause of the missing adjacency?

A network engineer has deployed Cisco Catalyst SD-WAN Cloud OnRamp for Multicloud with a cloud gateway in an AWS host VPC. The IPsec tunnels between the branch edge routers and the cloud gateway show as up, but the branch VPNs cannot reach workloads in the spoke VPCs. On the cloud gateway, 'show sdwan omp routes' displays the branch prefixes, but 'show ip route vrf 1' on the AWS spoke workload path shows no routes from the branch. The Transit Gateway route tables and TGW-to-VPC attachments are confirmed correct. What is the MOST likely cause of the reachability failure?