One tunnel of an AWS VPN connection goes silent. The campus IOS XE router keeps the route toward that tunnel because it never declares the peer dead. The second tunnel is up. What should be enabled?
Select an answer to reveal the explanation.
Short Explanation
When an AWS VPN peer stops responding, you don’t want your router to keep sending traffic toward that tunnel. Enable dead peer detection on the IPsec session so the silent tunnel is declared down and the second tunnel can carry traffic. A static route at distance 1 toward the dead tunnel would keep the black hole in place.
Full Explanation
Dead peer detection (DPD) exchanges liveness messages on the IPsec session. When the AWS peer goes silent, DPD lets the IOS XE router declare the security association down, so the route toward that tunnel can be removed and the second, healthy tunnel can forward traffic. Without DPD, the router may retain a route toward a tunnel that will not answer. OSPF demand circuits do not solve this: they are not a feature of the virtual private gateway, which will not withdraw the tunnel through OSPF. A static route at distance 1 toward the silent tunnel forces traffic into the black hole rather than detecting failure. An SD-WAN BFD hello is not appropriate on this standalone IOS XE router, and the virtual private gateway is not an SD-WAN TLOC. Exam caveat: DPD declares the peer down, but BGP may still be the protocol that withdraws the prefixes; you need both the IPsec session and the route to move to the healthy tunnel. Practical check: after enabling DPD, silence one AWS endpoint and verify that its security association drops and the VPC route moves to the tunnel that remains up.