A campus router uses GRE toward a cloud IOS XE router. The cloud router is a route-based VTI with no GRE. OSPF never starts, and a capture shows the encapsulations do not match. What should both sides use?
Select an answer to reveal the explanation.
Short Explanation
One side packed the cargo in a GRE envelope and the other side is listening for a different box. You put GRE with IPsec protection on both routers so OSPF has a tunnel it can share. A native gateway will not start OSPF to paper over the mismatch.
Full Explanation
OSPF between two IOS XE routers needs an encapsulation both ends agree on. GRE is the usual choice, protected by IPsec when the path crosses the internet. This campus sends GRE and the cloud router expects a route-based VTI, so the packets do not form one tunnel and OSPF never starts. Change the cloud router to GRE with IPsec protection, matching the campus. A native VPN gateway does not run OSPF and cannot translate the mismatch. Leaving the pair unmatched does not make OSPF ignore encapsulation. A public virtual interface does not convert VTI packets into GRE. Exam caveat: the IPsec profile has to land on the GRE tunnel at both ends. Matching GRE with only one side protected brings the tunnel up in the clear or drops it. Operational check: both interfaces should show GRE, both should show tunnel protection, and OSPF should reach Full.