top of page
Search

Cisco SD-WAN OMP Missing Routes: show omp routes When One Site Cannot Reach Another

  • 3 days ago
  • 2 min read
Cisco SD-WAN network security troubleshooting lab
Cisco SD-WAN · Techclick CLI troubleshooting lab
Control is up. Site A cannot reach Site B prefixes. Static ping to the TLOC works.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on Cisco SD-WAN for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

OMP is the overlay routing. show omp routes and advertised/received. A missing site-id, VPN, or policy filter is usual.

Why this ticket shows up

Healthy control does not guarantee every service prefix is advertised. Central policy can drop them.

Symptoms operators actually see

  • Empty omp routes for VPN 1

  • TLOC up

  • Central policy recently changed

  • site-id filtering

CLI first — copy this block

Run these on the Cisco SD-WAN device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

show omp routes vpn 1
show omp peers
show omp tlocs
show ip route vpn 1
show policy from-vsmart

How to read that output

If the prefix is not in omp routes, vSmart never gave it to you. from-vsmart policy is the first suspect.

Triage order

  1. Compare omp routes on both sites

  2. Check omp peers

  3. Read from-vsmart filters

  4. Advertise the LAN correctly in vpn 1

  5. Retest

Classic traps

What you see

Real cause

Fix

Add a static in vpn 0

This is overlay routing

Fix OMP

Rebuild control

Control is already up

Look at policy

Redistribute everything

Policy still drops

Fix the list

Proof the ticket is closed

  • Prefix in show omp routes

  • show ip route vpn 1 has it

  • Site-to-site ping works

Say this in an interview

I treat SD-WAN site reachability as OMP, not as IGP, once control is up.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments

bottom of page