A cloud-hosted Cisco IOS XE router has a public address on one interface and only private addresses on the VPC inside interfaces. Campus IKE never arrives. The tunnel source is set to an inside private interface. What should the tunnel source be?
Select an answer to reveal the explanation.
Short Explanation
You told the router to answer the door from a room that has no street front. You set the tunnel source to the internet-facing interface that owns the public address the campus is targeting. An inside private NIC is not that address, and a loopback with no address is not a source at all.
Full Explanation
The campus sends IKE to the public address. The cloud IOS XE router must source the tunnel from the interface that owns that address, which is the internet-facing interface. Sourcing the tunnel from an inside private interface makes the router build the session from an address the campus is not routing to, so the IKE packets never match the tunnel. AWS does not require a private source for this virtual router. The public address is what the campus can reach. A loopback with no address cannot be a tunnel source. The router needs a real address on the source interface. The campus LAN interface does not exist on the cloud router. Copying that name into the VPC device does not create the campus network. Exam caveat: the tunnel destination on the campus router must be that same public address, and the cloud firewall must permit UDP 500 and UDP 4500 to it. The source interface is the piece this configuration got wrong. Operational check: show interface tunnel on the cloud router should list the internet-facing interface as the source, and a capture there should show the campus IKE packets.