Voice PBR Fails Over to a Dead ISP Path

Data VLAN 10 has no policy routing, so its forwarding follows the RIB. When BFD brought down the tracked static default, the BGP default via ISP-B became the active default, and NAT overload on GE0/0/1 carried the data traffic. That part of the design worked as intended.

Voice VLAN 40 matches a PBR policy that redirects to 100.64.1.1 unconditionally. PBR is evaluated before the RIB, and the redirect has no health association. The outgoing interface remains up/up, so the next hop is still considered valid at the policy level and packets continue to be handed to ISP-A's gateway. BFD knows the path is dead, but that knowledge only removed the static route; it never reaches the policy behavior.

The result is a blackhole for voice: SIP REGISTER leaves the branch, never reaches the provider, and RTP is dropped upstream. A one-way-audio symptom can also appear if signalling briefly succeeded and media took a different path. The critical distinction is that the control plane correctly converged, while a policy-based forwarding decision overrode the converged RIB.

Option 1, preferred: associate the redirect with an NQA or track object. Create an ICMP NQA test toward 100.64.1.1 (or a provider-approved target) with a short interval and failure threshold, then bind it to the PBR behavior so the redirect is withdrawn when the probe fails. When the behavior no longer matches, the traffic falls through to the RIB and uses the ISP-B default. If the platform supports track on the redirect action, use it directly; otherwise use a policy node that matches only while the track is up and a fall-through node after it.

Option 2: remove PBR for voice and use a source-based route-policy in BGP, preferring ISP-A with a higher local preference and accepting ISP-B as backup. This is cleaner to operate but does not guarantee the fixed next hop the SIP provider may require.

Option 3: a floating static route for the voice provider's destination with track bfd and a higher preference on ISP-B, combined with source NAT on both interfaces. This avoids PBR entirely but may not satisfy a provider that demands a specific source address.

Whichever option is chosen, verify with display traffic policy statistics and a controlled link failure, and confirm the failover completes within the BFD and NQA timers.

The provider constraint is the real blocker. SIP registration is accepted only from 100.64.1.2, which belongs to ISP-A. If the redirect moves to ISP-B, the source address becomes the LTE address, typically dynamic, and the provider will reject the registration or drop media as spoofed. Correct PBR health tracking makes the branch fail over faster, but it fails over to a path the provider does not authorize. NAT does not fix this: hiding behind another address changes the identity the provider is filtering on.

The design also has a return-path problem: if the provider does accept the new source, responses must come back to the LTE address, which requires the NAT binding to be active on GE0/0/1 for the voice subnet and any provider-side routing to be updated.

Escalate the requirement, not just the configuration: obtain a static address and provider acceptance on ISP-B, or a second fibre from the same provider with diverse routing, or a provider-hosted secondary SBC that accepts registration from a second address. Until then, document that voice has no resilient WAN path and that the PBR is masking a single-homed service dependency.