A university edge running Cisco IOS XE must bring up internet connectivity to a native AWS virtual private gateway. Which tunnel configuration matches that endpoint?
Select an answer to reveal the explanation.
Short Explanation
AWS is not going to speak GRE just because your router likes it. You bring a route-based IPsec tunnel, IKEv2, and a transform the virtual private gateway will actually negotiate. A bare GRE interface never finishes the handshake.
Full Explanation
A native AWS Site-to-Site VPN endpoint terminates IPsec. On Cisco IOS XE the matching construct is a route-based virtual tunnel interface protected by an IKEv2 profile and an IPsec transform the gateway accepts, with routing by BGP or static routes. A GRE tunnel that has no IPsec protection is the wrong encapsulation. The virtual private gateway does not terminate plain GRE, so the interface stays down. OSPF configured toward that gateway cannot form. AWS VPN connectivity uses BGP or static routing, not OSPF on the virtual private gateway. A policy-based crypto map limited to a single host proxy identity negotiates, at best, a security association that does not cover the campus and VPC prefixes, so production traffic never matches. Exam caveat: some SIG and cloud-hosted IOS XE designs do use GRE, but that is a different far end than a native virtual private gateway. Operational check: show crypto ikev2 sa and show crypto ipsec sa should both be up to the AWS outside tunnel addresses before you troubleshoot BGP.