In a data center (DC) with two ION devices, all of the remote branch Prisma...

Comprehensive and Detailed Explanation

In a Prisma SD-WAN Data Center deployment, the operational state of theSecure Fabric VPNs(overlay tunnels) is directly tied to the health of theBGP Core Peerconfiguration.4

Core Peer Dependency:DC ION devices typically peer with the data center core switch (Core Router) via BGP to learn the subnets (prefixes) for the applications hosted in the DC. The Prisma SD-WAN controller monitors this BGP peering status.5

Controller Logic:If theBGP Core Peeron a DC ION goes down (or is not established), the controller automatically marks the VPN tunnels terminating at that specific ION as"Inactive".6This is a fail-safe mechanism designed to prevent remote branches from sending traffic to a DC ION that has lost conne7ctivity to the internal data center network (and thus the applications).

Scenario Analysis:In this scenario, DC ION-1 has active VPNs, meaning its BGP Core Peer is UP and it is successfully advertising reachability. DC ION-2 hasnoactive VPNs, which strongly indicates that itsBGP Core Peer is down.8Because the controller sees the peer is down, it suppresses the tunnel establishment or marks existing tunnels as inactive to ensure traffic is only directed to the healthy node (ION-1).