A manufacturer IOS XE router has no IKEv2 SA and no IPsec SA to an AWS virtual private gateway. Pings to the gateway's public address succeed. What should the engineer compare next?
Select an answer to reveal the explanation.
Short Explanation
You can reach the building, but nobody is starting the handshake. Since reachability is fine, compare the IKE version, pre-shared key, and proposal with the AWS VPN connection; BGP comes into play only after the tunnel is up.
Full Explanation
A successful ping shows that the AWS public address is reachable, but no IKEv2 SA means IKE phase 1 has not completed. Compare the router’s IKE version, pre-shared key, and proposal with the corresponding settings on the AWS VPN connection; a mismatch can prevent the SA from forming. The BGP ASN is not checked until the tunnel can carry the BGP TCP session, so it cannot explain the missing IKE SA. An OSPF hello timer on the campus LAN is unrelated because the virtual private gateway does not form OSPF. A BFD multiplier for an SD-WAN cloud TLOC is also irrelevant: this is a standalone IOS XE router, not an SD-WAN peer using that TLOC. Exam caveat: even when the IKE settings match, a firewall that permits ping but blocks UDP 500 or UDP 4500 can keep the SA down, so include those ports in the path check. Practical check: use show crypto ikev2 sa to confirm whether the SA forms after correcting the settings; investigate BGP only once the tunnel is established.