A campus IOS XE tunnel toward an AWS outside address stays line-protocol down. The tunnel destination is correct, and the routing table has no route to that address. What should be added?
Select an answer to reveal the explanation.
Short Explanation
The tunnel cannot even aim at a destination the routing table does not know. You add a route to the AWS outside address out the internet-facing interface. BGP and OSPF are conversations that happen after that route exists, and this router is not an SD-WAN edge.
Full Explanation
A GRE or IPsec tunnel interface stays line-protocol down when the router has no route to the tunnel destination. The outside address is correct and simply not reachable from this table. A route, usually a default or a specific route, out the internet-facing interface lets the router encapsulate toward AWS. An OSPF neighbor on the virtual private gateway is not how that gateway learns a path to its own public address, and it does not run OSPF. A BGP password cannot bring line protocol up before the tunnel exists. BGP starts inside the tunnel. An SD-WAN TLOC is not a configuration object on this standalone IOS XE router. Exam caveat: a route that points the outside address back into the tunnel itself is a recursive loop. The route to the peer must use the physical internet interface, not the tunnel. Operational check: show ip route for the outside address should list the internet interface, and the tunnel line protocol should then come up.