A clinic hosts one Cisco IOS XE router in a VPC as the only IPsec headend for the campus. A failure of that router isolates the VPC. They can add a second virtual router. What should the second router do?
Select an answer to reveal the explanation.
Short Explanation
One router in the cloud is one power cord. You give the second virtual router its own IPsec tunnel and you point a VPC route at it, so the campus still has a headend when the first router dies. Copying the first address onto both boxes does not make two sessions.
Full Explanation
A second Cisco IOS XE router in the VPC is a second headend only if it terminates its own tunnel and the VPC route table can send campus traffic to it, with the campus preferring one and failing over to the other. That removes the single virtual router as a failure. OSPF with the native virtual private gateway does not make that gateway an IOS XE headend, and the gateway will not run OSPF to replace these routers. Two routers cannot usefully share one private address and one IKE session. Each needs its own address and its own security association. iBGP without a tunnel does not give the campus a path into the VPC. The campus still has to land on a router that is actually up. Exam caveat: disable source and destination checks, or enable IP forwarding on the cloud NIC, for whichever provider you use, or the second router will accept IKE and still drop transit packets. Operational check: shut the first virtual router and confirm the campus IPsec session moves to the second and a VPC host still answers.