A stadium placed a Cisco IOS XE router in a cloud VPC to terminate IPsec from the campus. The campus router is behind NAT. IKE never completes. The cloud firewall allows only TCP 22 to the virtual router. What must that firewall also allow?
Select an answer to reveal the explanation.
Short Explanation
NAT hides the campus router, so IKE needs its NAT-T door, not an SSH pinhole. You allow UDP 500 and UDP 4500 to the cloud IOS XE router. BGP and HTTPS do not negotiate the IKE handshake for you.
Full Explanation
IKEv2 uses UDP 500. When either peer is behind NAT, the peers detect the NAT and switch the datagrams to UDP 4500, which is NAT-T. The stadium's cloud IOS XE router never sees the campus handshake if the VPC firewall permits only TCP 22. Opening UDP 500 and UDP 4500 from the campus address is what lets IKE complete. TCP 179 is BGP. BGP starts after the tunnel can carry it. It does not authenticate IKE, and it cannot bring the tunnel up. ICMP echo is a reachability test. IKEv2 is not negotiated inside echo requests. TCP 443 is ordinary HTTPS. NAT-T does not move to TCP 443 when UDP is closed. If UDP 4500 stays blocked, NAT-T stays blocked. Exam caveat: a native cloud VPN gateway has the same UDP needs, but the firewall in this question is the one in front of the virtual IOS XE router you deployed, often a security group or network security group. Operational check: after the rule is in place, show crypto ikev2 sa on the campus router should leave the idle state, and a capture on the virtual router should show UDP 4500 from the campus public address.