An Azure VPN gateway is active-active and has two public addresses. The campus IOS XE router has one route-based tunnel to the first address only. What must be added so both instances are used?
Select an answer to reveal the explanation.
Short Explanation
Active-active means both doors are already open, and you have only knocked on one. You build a second route-based IPsec tunnel to the other public address. Another static route to the first address does not wake the instance you never peered with.
Full Explanation
Each instance of an Azure active-active VPN gateway has its own public address and expects its own IPsec tunnel. The campus router must terminate a route-based tunnel on each address or the second instance sits idle. A second static route toward the first address only adds another way to name the same peer. It does not create a tunnel to the second instance. The Azure gateway does not run OSPF, so a neighbor statement there cannot bring the second instance into the design. A GRE keepalive is not how Azure activates the second VPN instance. The native gateway is expecting the second IPsec session. Exam caveat: Azure may send return traffic on either tunnel. The campus router should accept both, and a firewall that demands one symmetric path will drop the flow that comes back on the other tunnel. Operational check: show crypto ipsec sa should list two peers, one for each Azure public address, and both tunnel interfaces should be up.