A regional Catalyst SD-WAN hub is selected as a Cloud OnRamp for SaaS gateway for Microsoft 365. The hub has only an MPLS transport and no internet exit. Gateway probes from that hub do not appear. Why?
Select an answer to reveal the explanation.
Short Explanation
You cannot staff a lookout tower that has no window. You picked a hub with only MPLS and no internet exit, so it cannot probe Microsoft 365. Shutting OMP or waiting for a virtual private gateway does not create that window.
Full Explanation
A Cloud OnRamp for SaaS gateway measures the application from a site that can reach it on the internet. This hub's only transport is MPLS, with no internet exit, so there is no interface from which to send the gateway probe. That is why the probes are absent. Shutting OMP would remove the overlay the branches use to reach the hub. It is not a prerequisite for probing. An AWS virtual private gateway does not generate Catalyst SD-WAN SaaS probes. A zone-based firewall does not create those probes when tunnels go down. Taking the data-center tunnels down would blackhole the branches that were supposed to use the gateway path. Exam caveat: a branch can still have its own local probe if that branch has internet. The missing piece here is the gateway measurement, not every site in the network. Operational check: give the hub an internet exit that can reach Microsoft 365, then confirm the gateway probe appears and branches can be steered toward it.