A cloud IOS XE router advertises its GRE tunnel subnet to the campus by BGP, and that subnet is more specific than the path used to reach the tunnel destination. The tunnel then drops. What should be filtered?
Select an answer to reveal the explanation.
Short Explanation
You told the campus that the best way to the tunnel is through the tunnel. You filter that tunnel subnet so it is not advertised back. The more specific route steals the path the tunnel needs, and the IKE identity is not what installed it.
Full Explanation
If the cloud router advertises the GRE tunnel subnet toward the campus, the campus can prefer that prefix as the way to reach the tunnel destination or the tunnel itself. The more specific route points into the tunnel whose outside path it just replaced, and the tunnel drops. Filter the tunnel subnet outbound. Do not filter every campus prefix. The campus still needs its own networks, and removing them does not fix the leaked subnet. The IKE identity does not create a BGP route. Anti-replay does not install the tunnel subnet. BGP did, because it was redistributed or covered by a network statement. Exam caveat: also keep the tunnel source and destination, if they are public addresses the campus must reach via the internet, from being pulled into the tunnel. The filter should name the tunnel subnet specifically. Operational check: show ip bgp neighbors advertised-routes should no longer list the tunnel subnet toward the campus, and the tunnel should stay up.