Guest wireless users on a hospital Catalyst SD-WAN edge cannot open web sites. The SIG tunnel is up, staff in another service VPN can browse, and the guest zone-pair drop counter rises with each test. What explains the failure?
Select an answer to reveal the explanation.
Short Explanation
You’ve confirmed the SIG tunnel is up and staff can browse, so the path is available. The rising guest drop counter points to the zone-based security policy blocking guest traffic before it reaches the SIG tunnel; adjust that policy rather than rebuilding the tunnel.
Full Explanation
The rising guest zone-pair drop counter identifies the zone-based security policy as the point where guest traffic is discarded, before it can use the SIG tunnel. The tunnel is up, and staff in another service VPN can browse, confirming that the internet-security path is available for traffic the policy permits. A down SIG tunnel would disrupt web access for staff and guests, rather than produce a guest-specific zone-pair drop. Cloud OnRamp for Multicloud provides paths toward cloud workloads; it does not, by itself, replace the guest default route with a VPC summary, and that change would not explain the rising guest zone-pair counter. Application-aware routing with a strict MPLS SLA class can drop traffic when no tunnel meets the SLA, but the evidence here is a firewall counter, not an SLA drop, while staff browsing confirms a usable internet path. Exam caveat: once the zone pair permits guest traffic, a data policy must still steer it into the SIG tunnel; permitting direct DIA instead would bypass inspection. Practical check: compare guest zone-pair hits with a staff flow, permit guest web traffic toward the SIG zone, then verify that a new guest session is inspected rather than dropped.