This article details the approach users must take to understand why traffic may not be passing through LIBO.
In Software Defined Wide Area Network (SD-WAN) terms, LIBO means Local Break-Out.
If you see that traffic is not passing through, it might be an indication that traffic is exiting out via other interfaces or that there are flow issues on the firewall.
To troubleshoot this problem, perform the following steps:
Determine the traffic that is impacted (determine the Source and Destination IP addresses that are impacted).
Determine whether the entire traffic is impacted or a specific application or traffic is impacted.
In Contrail Service Orchestration, check for any changes that has happened for the specific site. (You may find this in Jobs for the specific tenant. See About the Jobs Page | Juniper Networks for more information.)
If yes, assess the change and decode if the said change includes the impacted traffic.
If not, log in to the Spoke device and check whether you see a session.
If you do not see a session, it means that traffic is not coming to the spoke or the spoke is receiving and dropping the traffic.
A flow trace on the SRX device will help to see whether traffic is incoming and traffic is being dropped.
The flow trace will provide further insight into whether the spoke firewall is allowing or dropping traffic. One possibility for traffic being dropped is that there is no firewall policy for the traffic allowed. See KB16233 - [SRX] How to use "flow traceoptions" and "security datapath-debug" [juniper.net] for more details.
After you confirm whether traffic is being allowed or dropped, from the SRX device side, you can use "match policy" (see show security match-policies | Junos OS | Juniper Networks) to understand whether this is due to firewall behavior or the device does not have a policy configured at all.
Configure the firewall policy via CSO and verify that traffic works now.
2023-12-28: Article created