yes, but weirdly enough after removing the policy from vsmart I still have access between sites. Maybe the policy insert routes and leave it there even when I already removed the policy I even restarted the vsmart and vEdges ?
show control connections
PEER PEER CONTROLLER
PEER PEER PEER SITE DOMAIN PEER PRIV PEER PUB GROUP
TYPE PROT SYSTEM IP ID ID PRIVATE IP PORT PUBLIC IP PORT LOCAL COLOR PROXY STATE UPTIME ID
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
vsmart dtls 1.1.1.2 100 1 10.10.1.7 12346 10.10.1.7 12346 public-internet No up 0:00:31:37 0
vbond dtls 0.0.0.0 0 0 10.10.1.6 12346 10.10.1.6 12346 public-internet - up 0:00:51:04 0
vmanage dtls 1.1.1.1 100 0 10.10.1.5 12346 10.10.1.5 12346 public-internet No up 0:00:51:03 0show control local-properties
personality vedge
sp-organization-name MSI
organization-name MSI
root-ca-chain-status Installed
certificate-status Installed
certificate-validity Valid
certificate-not-valid-before Jan 12 21:04:18 2021 GMT
certificate-not-valid-after Jan 10 21:04:18 2031 GMT
dns-name 10.10.1.6
site-id 300
domain-id 1
protocol dtls
tls-port 0
system-ip 3.1.1.1
chassis-num/unique-id 4bcae5f0-fd3d-d801-4065-602863ccbf93
serial-num EDF456A2
subject-serial-num N/A
token Invalid
keygen-interval 1:00:00:00
retry-interval 0:00:00:18
no-activity-exp-interval 0:00:00:20
dns-cache-ttl 0:00:02:00
port-hopped TRUE
time-since-last-port-hop 0:00:51:24
pairwise-keying Disabled
embargo-check success
cdb-locked false
number-vbond-peers 1
INDEX IP PORT
-----------------------------------------------------
0 10.10.1.6 12346
number-active-wan-interfaces 1
NAT TYPE: E -- indicates End-point independent mapping
A -- indicates Address-port dependent mapping
N -- indicates Not learned
Note: Requires minimum two vbonds to learn the NAT type
RESTRICT/ LAST VM
PUBLIC PUBLIC PRIVATE PRIVATE PRIVATE MAX CONTROL/ LAST SPI TIME NAT CON
INTERFACE IPv4 PORT IPv4 IPv6 PORT VS/VM COLOR STATE CNTRL STUN LR/LB CONNECTION REMAINING TYPE PRF
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
ge0/0 10.10.1.8 12366 10.10.1.8 :: 12366 1/1 public-internet up 2 no/yes/no No/No 0:00:00:16 0:11:28:01 N 5
show bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
2.1.1.1 200 up public-internet public-internet 10.10.1.8 10.10.10.6 12346 ipsec 7 1000 0:00:50:17 0show omp peers
R -> routes received
I -> routes installed
S -> routes sent
DOMAIN OVERLAY SITE
PEER TYPE ID ID ID STATE UPTIME R/I/S
------------------------------------------------------------------------------------------
1.1.1.2 vsmart 1 1 100 up 0:00:32:43 1/1/1 show omp tloc
Possible completions:
tloc-paths Display TLOC paths
tlocs Display TLOCs
vEdge-HQ# show omp tlocs
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Stg -> staged
IA -> On-demand inactive
Inv -> invalid
PUBLIC PRIVATE
ADDRESS PSEUDO PUBLIC PRIVATE PUBLIC IPV6 PRIVATE IPV6 BFD
FAMILY TLOC IP COLOR ENCAP FROM PEER STATUS KEY PUBLIC IP PORT PRIVATE IP PORT IPV6 PORT IPV6 PORT STATUS
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
ipv4 2.1.1.1 public-internet ipsec 1.1.1.2 C,I,R 1 10.10.10.6 12346 10.10.10.6 12346 :: 0 :: 0 up
3.1.1.1 public-internet ipsec 0.0.0.0 C,Red,R 1 10.10.1.8 12366 10.10.1.8 12366 :: 0 :: 0 up show omp routes
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
PATH ATTRIBUTE
VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE
--------------------------------------------------------------------------------------------------------------------------------------
10 10.22.1.0/24 1.1.1.2 1 1003 C,I,R installed 2.1.1.1 public-internet ipsec -
10 10.40.40.0/24 0.0.0.0 69 1003 C,Red,R installed 3.1.1.1 public-internet ipsec - show bfd tloc-summary-list
IF SESSIONS SESSIONS SESSIONS
NAME ENCAP TOTAL UP FLAP
--------------------------------------------
ge0/0 ipsec 1 1 2
