A studio must send multicast from the campus to an application in a VPC. A native site-to-site VPN is up and unicast works. Multicast never arrives. What should terminate the campus tunnel inside the VPC?
Select an answer to reveal the explanation.
Short Explanation
Unicast is through, and the native gateway still will not carry the multicast stream. You terminate the campus tunnel on a Cisco IOS XE router in the VPC that can run multicast with the campus peer. A longer IKE lifetime does not turn that gateway into a multicast router.
Full Explanation
Native cloud VPN endpoints forward the unicast IPsec session. They do not run multicast with the campus the way two Cisco IOS XE routers can. Unicast success only proves the VPN. Put an IOS XE router in the VPC, build the protected tunnel to it, and run the multicast design on that router and the campus peer. The native VPN gateway will not start forwarding the stream because unicast already works. A public virtual interface is for public service prefixes on a private interconnect. It is not a multicast path into a VPC. The IKE lifetime has no relationship to whether a packet is multicast. Exam caveat: the VPC route tables and any security rules still have to allow the multicast group past the cloud router. The router only solves the tunnel. Operational check: the campus and the cloud IOS XE router should show the group, and a capture on the application subnet should show the stream.