A campus IOS XE router uses certificate authentication toward an AWS virtual private gateway. Small IKEv2 exchanges start, then the negotiation stalls, and a capture shows large UDP 500 packets dropped on the path. What should the router enable?
Select an answer to reveal the explanation.
Short Explanation
You can think of the large certificate exchange as a package that cannot fit through the path. Enable IKEv2 fragmentation so the exchange is split into pieces the path can carry; BGP keepalives, an OSPF MTU override, and an SD-WAN BFD poll do not carry this certificate.
Full Explanation
Certificate authentication makes IKEv2 messages large. If a device on the path drops oversized UDP packets rather than forwarding them, the negotiation can start and then stall. IKEv2 fragmentation lets the router split those messages into pieces the path can carry. Here, the capture shows large UDP 500 packets being dropped, so fragmentation addresses the observed failure. A shorter BGP keepalive does not split a certificate into BGP updates, and BGP is not carrying the certificate exchange. An OSPF MTU override on the virtual private gateway does not fragment IKE; OSPF is not the protocol carrying this negotiation. An SD-WAN BFD poll likewise does not carry a certificate for this standalone router. Exam caveat: fragmentation must also be supported by the AWS virtual private gateway so it can reassemble the IKEv2 fragments. If it cannot, enabling fragmentation alone will not resolve the negotiation failure. Practical check: after enabling it, inspect a capture for the IKE exchange completing and use show crypto ikev2 sa to confirm that the security association reaches a ready state.