A Cisco IOS XE router in Azure has an up tunnel, a route to the campus, and a subnet route that points the campus prefix at its NIC. Transit packets toward application hosts are still dropped. IP forwarding on that NIC is disabled. What must be enabled?
Select an answer to reveal the explanation.
Short Explanation
You have a working tunnel and the routes are in place, but the cloud network still needs permission to pass transit traffic through the router. Enable IP forwarding on its NIC; another IKE identity will not provide that permission.
Full Explanation
Cloud platforms drop packets arriving at a virtual NIC when their destination is not that NIC unless forwarding is enabled. Azure calls this setting IP forwarding. Here, the tunnel is up, the router has a route to campus, and the subnet route points the campus prefix at the NIC, so the packets reach the NIC but are then discarded. Enable IP forwarding on that NIC to allow the router to forward transit packets. Negotiating a second IKE identity does not change NIC forwarding, so it cannot resolve this drop. OSPF on the native VPN gateway does not enable forwarding on the virtual router's NIC; the gateway does not have an OSPF process that toggles that NIC setting. Giving every application host a public address would bypass the router and expose hosts that the design keeps private, rather than enable the intended transit path. Exam caveat: on AWS, the corresponding control is the source/destination check, which must be disabled for a virtual router; use the forwarding control provided by the cloud platform in the question. Practical check: confirm that IP forwarding is enabled on the NIC, then test whether a campus host can reach an application host through the router.