A bank IOS XE router will use a native AWS virtual private gateway with BGP. Which IPsec style matches that route-based endpoint?
Select an answer to reveal the explanation.
Short Explanation
You’re looking for a route-based IPsec tunnel that can carry the prefixes BGP advertises, not a narrow path for one management host. Build a virtual tunnel interface with broad traffic selectors and use BGP to exchange prefixes. A GRE tunnel without an IPsec profile won’t establish the required IPsec tunnel to the gateway.
Full Explanation
Native AWS Site-to-Site VPN on a virtual private gateway is a route-based IPsec service. On IOS XE, the matching design is a virtual tunnel interface protected by IPsec, with traffic selectors broad enough to cover the traffic the route-based gateway expects; BGP then determines which prefixes use the tunnel. A crypto map bound to an ACL naming only the router’s management host negotiates a narrow selector, so production-prefix traffic will not match it and the VPC will not see those flows. A GRE tunnel sourced from the campus LAN interface but lacking an IPsec profile uses the wrong encapsulation and cannot establish the required IPsec tunnel to the virtual private gateway. An OSPF point-to-point network is not supported on that gateway: AWS does not form an OSPF adjacency there to learn VPC prefixes. Exam caveat: a policy-based device can sometimes interoperate with AWS using specific selectors, but those selectors must cover the real prefixes; a single management host is not sufficient. For an operational check, use show crypto ipsec sa to verify the broad selectors and show ip bgp summary to confirm that BGP is Established across the tunnel.