A new edge never forms control connections. Ping to the controller addresses works. The edge clock is a day behind, so its certificate is not yet valid. What should be corrected?
Select an answer to reveal the explanation.
Short Explanation
The certificate is fine tomorrow and the edge still thinks tomorrow has not happened. You set the clock so the certificate is inside its valid time. The controllers already answer ping, so this is not a missing route.
Full Explanation
Control connections check the certificate against the edge clock. A clock a day behind makes a valid certificate look not-yet-valid, so the edge never joins even though the controller addresses answer ping. Set the clock, or point the edge at a time source, and let the certificate fall inside its window. The cloud gateway region does not reject the clock. The edge has not joined the overlay yet. A voice application list does not set the time. A guest zone pair does not have to permit the clock for the control connection to form. Exam caveat: a correct clock with an expired certificate, or the wrong organization name, still fails. If control stays down after the time is right, check those next. Operational check: the edge clock should match real time, and show sdwan control connections should list the controllers up.