Your on-premises data center has 2 routers connected to your GCP through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN…

Question

Options

• AOne of the VPN sessions is configured incorrectly.
• BA firewall is blocking the traffic across the second VPN connection.
• CYou do not have a load balancer to load-balance the network traffic.
• DBGP sessions are not established between both on-premises routers and the Cloud Router.

• A
  81% (35)
• B
  7% (3)
• C
  2% (1)
• D
  9% (4)

Explanation

The key diagnostic clue is the 'no-proposal-chosen' error in the VPN logs. This is an IKE (Internet Key Exchange) negotiation error that occurs when the two VPN endpoints cannot agree on a common set of encryption/authentication parameters (cipher suites, DH groups, IKE version, etc.). It indicates a misconfiguration in one of the VPN sessions - the IKE proposals on one side don't match the other. The BGP session not being established (option D) is a downstream symptom: BGP runs over the tunnel, so if the tunnel never comes up due to IKE failure, BGP cannot establish. The root cause is the VPN session misconfiguration, not a firewall (B) - which would show different errors - and not a missing load balancer (C), which is irrelevant to VPN routing.

No community discussion yet for this question.