Thank you! Very helpful information collected together in one document. It would be also great to add information how to configure different VPC implementations to work with the provided solutions. For example, I'm thinking about having a few subnets in different AWS security zones (let's say one subnet would be like a traditional DMZ on external security zone with the servers on elastic IP addresses  accessible from the Internet while other subnets on internal security zone accessible on permitted protocols/port from servers on external security zone). Probably it would be possible to make all traffic going through the CSR, but I think the simpler approach would be to have a separate AWS Internet GW for subnets on external security zone while the subnets on internal security zone configured with the default route pointing to CSR (internal interface) and CSR's external interface pointing its default into another AWS Internet GW. Or maybe it's better to use the same AWS IGW for both? In any case, I've found a lot of useful information in the posted document. That saved me time.   ... View more

Hi, Sorry didn't see this question earlier. Most likely you are hitting the bug CSCuy96961. Here is the workaround: Add the following eem to both CSR configuration and reboot the router. This should be fixed in IOS-XE 16.3. event manager applet restart-csrmgmt  description "disable/enable csr_mgmt after Gi1 gets DHCP IP address"  event syslog pattern "%DHCP-6-ADDRESS_ASSIGN: Interface GigabitEthernet1"  action 1.0 syslog msg "%dCloud-vPodGW: Starting eem restart-csrmgmt"  action 1.1 cli command "enable"  action 1.2 cli command "config terminal"  action 1.3 cli command "virtual-service csr_mgmt"  action 1.4 cli command "no activate"  action 1.5 syslog msg "%dCloud-vPodGW: Disabled csr_mgmt and waiting for 10 seconds"  action 1.6 wait 10  action 1.7 cli command "activate"  action 1.8 syslog msg "%dCloud-vPodGW: Enabled csr_mgt and exiting eem restart-csrmgmt"  action 1.9 cli command "end" ... View more