A Cisco IOS XE router in a cloud VPC has only a private address in a private subnet. There is no public address and no inbound path from the internet. Campus IKE packets never arrive. What is missing?
Select an answer to reveal the explanation.
Short Explanation
The campus is sending IKE to a router the internet cannot reach. You give the cloud router a public address and a path that actually delivers inbound IKE. A private subnet with no inbound path will never see those packets, and BGP does not start the handshake.
Full Explanation
IKE from the campus crosses the internet, so the cloud IOS XE router needs a destination the campus can route to and a path that delivers inbound UDP. A private address in a private subnet, with no public address and no inbound path, never receives that traffic. Add a public address on an interface the internet can reach. OSPF on the native VPN gateway does not receive IKE for this virtual router. BGP cannot run before the tunnel exists, so a shorter keepalive does not deliver IKE. A public virtual interface is a Direct Connect construct for public services. It is not how a private router receives internet IKE. Exam caveat: the cloud firewall and the router ACL still have to permit UDP 500 and UDP 4500 after the address exists. The missing address is the first gap. Operational check: the campus peer address should match the new public address, and a capture on that interface should show the IKE packets.