A factory Catalyst SD-WAN edge has BFD up to the regional cloud gateway, firewall drop counters at zero, and no OMP route for an Azure prefix that other sites learn. A centralized control policy was just applied to this site list. What happened?
Select an answer to reveal the explanation.
Short Explanation
You can’t drop a package that was never put on the truck. With BFD up and firewall counters quiet, the missing Azure prefix points to the new control policy filtering it from this site’s OMP routes, while other sites still learn it.
Full Explanation
A centralized control policy determines which OMP routes a site receives. BFD being up confirms connectivity to the regional cloud gateway, while zero firewall drop counters provide no evidence that the zone-based firewall is discarding traffic. Most importantly, the Azure prefix is absent from this site’s OMP routes even though other sites learn it; because the control policy was just applied to this site list, it is filtering the prefix before the edge can install it. A zone-based firewall drops traffic after routes are available to forward it, so it does not explain a missing OMP route. Application-aware routing strict mode can prevent traffic from using a tunnel that fails its SLA, but it does not remove the OMP route; the prefix remaining available at other sites also argues against a global SLA failure. An IKE pre-shared key on a native Azure VPN gateway concerns authentication to that standalone VPN peer, not the SD-WAN cloud gateway TLOC; BFD to the TLOC is already up. Exam caveat: check that the centralized policy’s site-list match includes this edge before attributing the missing route to its prefix rule. Practical check: run show sdwan omp routes for the Azure prefix on this edge and on a site outside the filter, then inspect the policy preview for a reject matching the prefix and site list.