Campus and cloud Cisco IOS XE routers send OSPF hellos across a protected GRE tunnel. Both are in area 0 with the same network type and the same MTU. The adjacency stays down and the keys on the two tunnel interfaces differ. What is the fault?
Select an answer to reveal the explanation.
Short Explanation
The packets are arriving, and the password inside them does not match. You set the same OSPF authentication key on both tunnel interfaces. Area, network type, and MTU already agree, so the key is what is left, and a virtual private gateway is not sitting in the middle of this adjacency.
Full Explanation
OSPF authentication rejects a hello that does not carry the expected key. The area, network type, and MTU already match, and hellos are being sent, so the differing keys are the remaining reason the adjacency stays down. Make the key on both tunnel interfaces the same. A missing IPsec profile would mean the hellos are not crossing an encrypted tunnel. The stem says the hellos are crossing, so the protection is already in place. The AWS virtual private gateway is not a member of this adjacency and does not hold a third OSPF key. BGP does not have to be removed for OSPF to check authentication. The two protocols are independent. Exam caveat: the authentication type has to match too. One side on plaintext and the other on a message-digest key fails even if the string you typed looks the same. Operational check: show ip ospf interface tunnel should show the same authentication type on both ends, and show ip ospf neighbor should reach Full after the keys match.