A government team placed a Cisco IOS XE router in a cloud VPC and gave it only a private address. Campus IKE packets never arrive, even though the cloud firewall allows UDP 500 and UDP 4500. What is missing?
Select an answer to reveal the explanation.
Short Explanation
You opened the right ports on a door that has no street address. The campus cannot send IKE to a router that only has a private address, so you put a public IPv4 address on the internet-facing interface. UDP 500 and 4500 are already allowed, and BGP is not the handshake.
Full Explanation
IKE from the campus crosses the internet, so the cloud IOS XE router needs a destination the campus can route to. A public IPv4 address on the internet-facing interface, such as an assigned public address on that NIC, gives the campus a target. The firewall already permits UDP 500 and UDP 4500, so the packet filter is not the missing piece. An OSPF process on the provider VPN gateway does not receive IKE for this virtual router, and that gateway is not the headend in this design. A BGP keepalive cannot start the session before IKE exists. BGP is carried after the tunnel is up. TCP 179 is BGP, not IKEv2. Allowing only that port would not carry the handshake and would ignore the UDP ports that are already open. Exam caveat: a public address on the router is reachable only if the subnet route to the internet, or the NIC's public mapping, actually delivers inbound UDP. A private subnet with no inbound path still drops the packets. Operational check: the campus crypto peer address should match the cloud router's public address, and a capture on that interface should show UDP 500 or 4500 arriving.