Campus and cloud IOS XE routers have an IPsec SA up. GRE over that session stays down. One side sets a GRE tunnel key and the other side sets none. What must agree?
Select an answer to reveal the explanation.
Short Explanation
You’re looking at a mismatch between the outer protection and the inner tunnel. Make the GRE tunnel key agree on both sides, including whether a key is used at all. Since the IPsec SA is already up, you can focus on GRE rather than IKE.
Full Explanation
A GRE tunnel key is checked on every packet, so both routers must use the same key—or both use no key. If one router sends a key while the other expects none, or their keys differ, GRE stays down even though IPsec is up and protecting the path. The OSPF process ID is not copied into the GRE key; it does not make the tunnel keys agree. The BGP ASNs do not have to match for GRE to pass traffic; eBGP uses different ASNs later. The IKE version is not the cause here: IKE has already succeeded, and a GRE key mismatch does not tear down the IPsec SA. Exam caveat: the GRE key is a local tunnel-interface setting, not something OSPF negotiates, so verify the setting on both peers rather than assuming another protocol supplies it. Practical check: compare the key configuration on both tunnel interfaces, confirm both show the same key setting (including key absence), then verify that the GRE interface comes up and passes a ping.