A university IOS XE router must exchange BGP routes with an Azure virtual network over internet IPsec. Which gateway and tunnel should they build?
Select an answer to reveal the explanation.
Short Explanation
BGP needs a gateway that actually speaks BGP. On Azure, that is a route-based VPN gateway, and your IOS XE router brings an IKEv2 route-based tunnel to it. A policy-based Basic gateway will not run the BGP session you asked for.
Full Explanation
Azure runs BGP only on a route-based VPN gateway, and not on the Basic SKU. The university router should build a route-based IPsec tunnel, normally IKEv2, to that gateway's public address and peer BGP across it. A policy-based Basic gateway is the legacy type. Microsoft documents it as a single site-to-site tunnel that does not support BGP, so it cannot meet the routing requirement. A plain GRE tunnel is the wrong encapsulation. The Azure VPN gateway terminates IPsec, not unprotected GRE. An OSPF adjacency on the Azure VPN gateway is not a feature of that gateway. Azure VPN routing to an on-premises IOS XE router is BGP or static, not OSPF. Exam caveat: several current route-based SKUs can negotiate IKEv1 or IKEv2, but the gateway type still has to be route-based before BGP is even an option. Operational check: the virtual network gateway configuration should show route-based and BGP enabled, and show ip bgp summary on the router should reach Established only after show crypto ipsec sa is up.