Phones in service VPN 10 take a lossy path to a cloud contact center. A strict voice policy exists and is attached only to VPN 20. Firewall counters are zero. Why do the phones miss the voice policy?
Select an answer to reveal the explanation.
Short Explanation
The good rule is hanging on the door next to the one your phones use. You attached the voice policy to VPN 20, and the phones sit in VPN 10, so the strict SLA never sees them. The firewall counter is quiet, so nobody is dropping the calls to force a path.
Full Explanation
Application-aware routing is applied to a VPN list. A strict voice policy attached only to VPN 20 does not match phones in VPN 10. Those phones follow whatever path VPN 10 uses, including the lossy one. Attach the policy to VPN 10, or move the phones into the VPN the policy already covers, if that is really their VPN. Firewall counters at zero rule out a zone-based drop as the reason the lossy path was chosen. OMP deleting the contact-center route would leave the phones with no route, not with a working lossy path. A SIG probe does not reclassify a service VPN. VPN 10 traffic stays in VPN 10. Exam caveat: after the policy matches VPN 10, strict will drop voice if no tunnel meets the class. Confirm that is what the clinic wants before the next outage looks like a total failure. Operational check: the policy's VPN list should include VPN 10, and a test call should take the voice SLA path instead of the bulk lossy path.