Guest web fails and guest ping to the SIG zone works. The zone pair permits only ICMP from the guest zone to the SIG zone. The SIG tunnel is up. What is missing from the zone pair?
Select an answer to reveal the explanation.
Short Explanation
Ping working only proves you allowed ping. You permitted ICMP toward the SIG zone and never permitted guest web, so the pages fail while the tunnel sits up. Web and ping can share that tunnel once the zone pair says so.
Full Explanation
A zone pair permits only what its rules name. ICMP is permitted, so guest ping to the SIG zone works. Web is not permitted, so guest web fails even though the SIG tunnel is up and the path is the same. Add a permit for the guest web traffic toward the SIG zone. A second SIG tunnel is not required for web to share a tunnel with ICMP. An OMP filter that removes ICMP does not create a web permit, and it would only break the ping that currently proves the path. A SaaS probe does not rewrite a zone pair. Exam caveat: if the policy is meant to inspect web at the SIG, the permit should point at the SIG zone and not at an uninspected DIA zone. Operational check: after the web permit is added, guest HTTP or HTTPS should complete and the ICMP permit can stay for troubleshooting.