An Azure route-based VPN connection is set to IKEv2 only. The campus IOS XE router offers only IKEv1. The pre-shared key matches and UDP 500 is open. IKE never completes. What must the router use?
Select an answer to reveal the explanation.
Short Explanation
You brought the right password to the wrong kind of handshake. You configure IKEv2, which is the only version this Azure connection will negotiate. A shorter IKEv1 lifetime is still IKEv1, and the gateway is not going to skip IKE for OSPF or for cleartext GRE.
Full Explanation
Azure lets a route-based connection require IKEv2. This connection is set that way, so an IOS XE router that offers only IKEv1 never finishes the negotiation, even when the pre-shared key is correct and UDP 500 is reachable. Change the router to IKEv2 and match the proposal the connection expects. Shortening the IKEv1 lifetime does not make IKEv1 acceptable to a connection that will not negotiate that version. OSPF authentication is not a substitute for IKE, and the Azure VPN gateway does not use OSPF to bring up a tunnel. Cleartext GRE is not what a route-based Azure gateway terminates. It expects IPsec. Exam caveat: several current Azure SKUs can do IKEv1 or IKEv2 when the connection allows both. This connection does not. Read the connection's protocol setting before changing ciphers at random. Operational check: show crypto ikev2 sa should appear toward the Azure public address after the router stops offering only IKEv1.