Campus and cloud IOS XE routers do not establish BGP. Each side uses the tunnel address as the neighbor. The tunnel masks differ, so the peers are not on one subnet. eBGP multihop is not configured. What should match?
Select an answer to reveal the explanation.
Short Explanation
The two neighbors are not on the same street, so the session never starts. You give the tunnel the same mask on both ends so the addresses share a subnet. The IPsec SA is not the thing a mask mismatch tears down.
Full Explanation
Direct eBGP, without multihop, requires the neighbor address to be on a connected subnet. Different masks put the two tunnel addresses on different subnets, so the session never establishes even if IPsec is up. Make the masks agree so both addresses fall in one subnet. The IKE identity is not this failure, and a mask mismatch does not bring the IPsec SA down. OSPF areas are not consulted before BGP reads a mask. Anti-replay does not drop TCP 179 because the masks differ. It drops reordered IPsec packets. Exam caveat: if you meant these to be loopback peers, matching the mask is the wrong fix. Add multihop and a route to the loopback instead. The stem uses the tunnel addresses with no multihop, so the mask is the fix. Operational check: each tunnel interface should show the same mask, and show ip bgp summary should move to Established.