An IOS XE router has two tunnels toward an AWS VPN connection. Tunnel 1 has an IPsec profile and an SA. Tunnel 2 has no profile and never forms an SA. What does tunnel 2 need?
Select an answer to reveal the explanation.
Short Explanation
The first tunnel is locked and the second one was left with no lock at all. You apply the IPsec profile on tunnel 2 and aim it at that tunnel's own outside address. Copying tunnel 1's address does not create the second SA.
Full Explanation
Each AWS tunnel has its own outside address and its own SA. Tunnel 2 never forms an SA because no IPsec profile is applied to it. Add the profile and set the destination to tunnel 2's outside address, not tunnel 1's. OSPF does not bring up an AWS tunnel, and the virtual private gateway will not accept an unprotected tunnel. Sharing tunnel 1's outside address makes both interfaces fight over one peer. A public virtual interface is not IPsec and is not how the second tunnel is protected. Exam caveat: the transform on tunnel 2 has to be one AWS will accept. A profile copied from a lab router can be applied and still fail the proposal. Operational check: tunnel 2 should show an SA to its own outside address, and both tunnels should be up on the AWS connection.