A store edge has BFD up to the AWS cloud gateway. OMP shows the VPC prefix in service VPN 20. User traffic is in service VPN 10, which has no such route. What is the mismatch?
Select an answer to reveal the explanation.
Short Explanation
The package arrived at the loading dock next door. You can see the VPC prefix in VPN 20, and the users are in VPN 10, which never received it. BFD is up, so this is the wrong service VPN and not a dead tunnel.
Full Explanation
OMP keeps routes per service VPN. A prefix installed in VPN 20 is invisible to hosts in VPN 10. BFD to the cloud gateway is up, so the transport is fine. The advertisement or the VPN attachment put the VPC into VPN 20, and the users were placed in VPN 10. Align the attachment and the user VPN. BFD cannot be the cause of a missing VPN 10 route while VPN 20 already displays the prefix and the session is up. An IKE pre-shared key on a virtual private gateway is not how this SD-WAN cloud gateway separates service VPNs. The data plane to the gateway is up. An expired SIG credential affects internet inspection tunnels. It does not move a VPC prefix between service VPNs, and the prefix is still present in VPN 20. Exam caveat: leaking the route between VPNs on purpose is a different policy. The fix here is to put the users and the prefix in the same service VPN unless a controlled leak is required. Operational check: show sdwan omp routes vpn 10 should list the VPC prefix after the attachment matches VPN 10, and a host in that VPN should reach a VPC instance.