Hosts in VPN 10 cannot reach hosts in VPN 30. OMP has routes both ways, BFD between the sites is up, and the zone-pair drop counter for VPN 10 to VPN 30 increases on each test. What is dropping the traffic?
Select an answer to reveal the explanation.
Short Explanation
You can follow the route, but the checkpoint counter clicks every time you try to use it. The zone-based security policy between VPN 10 and VPN 30 is dropping the traffic. OMP already has routes both ways, so a missing OMP route is not the cause.
Full Explanation
A rising drop counter for the zone pair between VPN 10 and VPN 30 identifies the zone-based security policy as the component discarding the flow. OMP has routes in both directions, and BFD between the sites is up, so the overlay has routes and an active connection for carrying the traffic. A missing OMP route for VPN 30 is therefore inconsistent with the evidence: it would leave the route unavailable, rather than explain why the zone-pair drop counter increases on each test. Application-aware routing does not remove BFD when an east-west flow starts; the stem explicitly says BFD is up. A SIG credential authenticates internet-inspection tunnels; it does not expire because two service VPNs communicate, and it does not account for this zone-pair counter. Exam caveat: if you correct the security policy and hosts still cannot communicate, check the return zone pair, since one direction can be permitted while the reverse direction is still dropped. Practical check: permit the required traffic on the VPN 10-to-VPN 30 zone pair, then confirm that its drop counter stops rising while a host in VPN 10 reaches a host in VPN 30.