A government campus must extend its existing OSPF domain across an IPsec path into a cloud VPC. The native cloud VPN gateway will not run OSPF. What should they deploy in the VPC?
Select an answer to reveal the explanation.
Short Explanation
You cannot teach the provider's VPN gateway a routing protocol it does not speak. You put your own IOS XE router in the VPC, terminate IPsec on it, and let OSPF form there. Static BGP into the native gateway never extends the OSPF domain.
Full Explanation
Native AWS, Azure, and Google Cloud VPN gateways exchange routes with BGP or with static configuration. They do not form OSPF adjacencies. When the campus must extend the existing OSPF domain into the VPC, the far end has to be a router you control. A Cisco IOS XE router hosted in the VPC terminates the IPsec tunnel from the campus and runs OSPF across that tunnel, then routes into the VPC subnets. Turning on an OSPF process on the provider virtual private gateway is not a supported configuration. That gateway is not an IOS XE router. Asking the native gateway to redistribute a static route into OSPF fails for the same reason: it has no OSPF process to redistribute into. BGP alone can pass prefixes into the VPC, and it is the right tool for a native gateway, but it leaves the campus OSPF domain unattached, which violates the requirement. Exam caveat: once the cloud IOS XE router is in place, guard mutual redistribution so VPC routes do not loop back into OSPF. Operational check: show ip ospf neighbor on both IOS XE routers should show Full across the tunnel, and the VPC prefixes should appear as OSPF routes on the campus edge.