300-415 Question 117
Single answerYou are configuring the Cisco SD-WAN data plane to ensure that branch routers can communicate securely with each other over the WAN. However, after completing the configuration, you notice that the branch routers are not establishing IPsec tunnels. What is the most likely cause of this issue?
- A
The TLOC color is not correctly configured on the branch routers.
- B
The vSmart controller is not reachable from the branch routers.
- C
The OMP (Overlay Management Protocol) sessions between the routers are not established.
- D
The branch routers are using different encryption algorithms for the IPsec tunnels.
Show answer and explanation
Correct answer: C
Explanation
In Cisco SD-WAN, OMP is responsible for exchanging routing information, TLOCs, and security parameters between vEdge devices. Without OMP sessions, the routers cannot exchange TLOC information, which is necessary for establishing secure IPsec tunnels. Ensuring OMP sessions are active is a critical step in configuring the data plane and enabling secure communication between branch routers.
- A. Incorrect.
While TLOC color is important for determining the type of transport (e.g., public or private), an incorrect TLOC color would not directly prevent the formation of IPsec tunnels. It would more likely impact traffic routing.
- B. Incorrect.
vSmart controller plays a key role in policy distribution and OMP session establishment. However, the lack of IPsec tunnels is not directly caused by vSmart being unreachable.
- C. Correct.
OMP (Overlay Management Protocol) is crucial for the establishment of IPsec tunnels, as it facilitates the exchange of TLOC information between routers. If OMP sessions are not established, the routers cannot exchange the necessary details to form IPsec tunnels.
- D. Incorrect.
While mismatched encryption algorithms would prevent IPsec tunnels from functioning correctly, they would not stop the tunnels from being initiated. This is less likely to be the root cause in this scenario.