A new Catalyst SD-WAN store edge has no control connections and an empty OMP table. Its local internet link can ping ordinary websites. The engineer has not yet checked reachability to the controller addresses. What is the first check?
Select an answer to reveal the explanation.
Short Explanation
The store can see the public web and still cannot see its own controllers. You check underlay routing and the firewall toward the controller addresses before you touch a SaaS list. OMP stays empty until those control connections exist, and a zone pair between service VPNs does not start them.
Full Explanation
Catalyst SD-WAN control connections are how the edge reaches the controllers and receives OMP. No control connections means an empty OMP table even when the internet link can ping public websites. Those pings only prove a general default route. The controllers use specific addresses and ports that a firewall can block while ordinary web traffic passes. Check underlay routing and that firewall path first. Cloud OnRamp for SaaS steers applications after the overlay exists. It does not bring up control connections. An Azure VPN gateway ASN belongs to a native IPsec BGP session. It does not authenticate this edge to the SD-WAN controllers. A zone-based firewall between service VPNs filters user traffic inside the overlay. It is not the process that starts OMP. With no control connection, that policy is not in effect from the controller yet. Exam caveat: certificates and the organization name also stop control connections, but only after the edge can reach a controller. Reachability is the check this symptom has not done. Operational check: a trace and a port test from the edge's internet transport to each controller address should succeed, then show sdwan control connections should list the controllers and OMP routes should follow.