Two university service VPNs on Catalyst SD-WAN can each reach AWS, and each has an OMP route to the other, but hosts in the two VPNs cannot communicate. Firewall drop counters on that zone pair are increasing. Which policy is responsible?
Select an answer to reveal the explanation.
Short Explanation
You can see the routes are present, but the traffic is being stopped at the firewall. Check the zone-based security policy between those VPNs; an application-aware routing SLA concerns path quality, not the firewall drops you’re seeing.
Full Explanation
Catalyst SD-WAN zone-based security policy decides which service VPNs, treated as zones, may communicate. Routes can be present in both directions while the firewall still drops the flow. Rising drop counters on that zone pair point to the security policy as the control matching the symptom. An application-aware routing SLA acts on tunnel loss, latency, or jitter targets by dropping or rerouting traffic; it does not account for zone-pair firewall counters. Both VPNs can also reach AWS, showing that the data plane to the cloud is up. Cloud OnRamp for SaaS selects paths for enabled SaaS applications; it does not, by default, suppress east-west traffic between campus service VPNs. A Secure Internet Gateway credential is used to authenticate tunnels to a cloud security provider, not to filter traffic between two internal VPNs or build the AWS cloud gateway. Exam caveat: routes being present does not guarantee that security policy permits traffic, so routing reachability and firewall authorization are separate checks. Practical check: inspect the security policy’s zone pair for the two service VPNs and confirm that a drop rule matches the host traffic you are testing.