A campus IOS XE router sits behind NAT. The tunnel source is a private loopback the NAT device does not translate. AWS never completes IKE, and the packets that arrive still show the private source. What should the tunnel source be?
Select an answer to reveal the explanation.
Short Explanation
AWS is seeing the private address you forgot to translate. You source the tunnel from an address the NAT device actually rewrites, so the public source is the one AWS expects. Using the AWS outside address as your own source points the tunnel at itself.
Full Explanation
The tunnel source is the address IKE is sent from, before NAT. If that address is a private loopback the NAT device does not translate, AWS receives a private source and will not complete the handshake to the public peer it has configured. Choose a source the NAT device translates, typically the interface that faces the NAT. Using the AWS outside address as the local tunnel source makes the router try to originate IKE from the destination. A loopback with no address cannot be a source, and NAT does not invent one during IKE. An Azure gateway address is a different peer and is not a legal source for this AWS session. Exam caveat: after the source is correct, UDP 4500 still has to pass, because the router is behind NAT. Fixing the source does not open a blocked NAT-T port. Operational check: a capture outside the NAT device should show the public source toward the AWS outside address, and show crypto ikev2 sa should come up.