Campus and cloud Cisco IOS XE routers form OSPF across an IPsec GRE tunnel and stick in EXSTART. The tunnel is up and ping between the tunnel addresses works. Interface MTU values differ. What is the cause?
Select an answer to reveal the explanation.
Short Explanation
OSPF will not trade maps if the two sides disagree on how big the page is. You are stuck in EXSTART because the tunnel MTU values differ, so the database description exchange never finishes. Ping only proves the tunnel passes small packets.
Full Explanation
OSPF neighbors that reach EXSTART have passed hellos and then fail while exchanging database description packets. A mismatched interface MTU is a classic reason: one side sends a description the other will not accept. The GRE tunnel is up and the tunnel addresses ping, so the underlay and IPsec are carrying packets. Make the tunnel MTU values match, or set the ignore-mtu check only if you accept the operational risk, and the adjacency can leave EXSTART. The AWS virtual private gateway is not in this adjacency. Both speakers are IOS XE routers, and a process ID is local to each router. It does not have to match for OSPF to form. BGP does not have to be removed for OSPF to progress. The two protocols can run together if redistribution is controlled. A mismatched IKE proposal would prevent the tunnel and the ping. Both already work. Exam caveat: matching MTU gets you to Full. You still need the VPC prefixes injected into OSPF on the cloud router or the campus learns an adjacency with an empty map. Operational check: show ip ospf neighbor should move from EXSTART to Full after the tunnel MTUs match, and show interface tunnel should list the same MTU on both ends.