300-415 Question 126
Select 4Your organization has deployed Cisco SD-WAN with multiple branch offices, and you notice that dynamic on-demand tunnels are being created between branch sites for direct communication. However, you observe that these tunnels are not forming in some cases. What could be the possible reasons for this behavior?
- A
The branch devices are using different colors for their TLOCs.
- B
There is a mismatch in the IPsec encryption settings between the branch devices.
- C
The OMP (Overlay Management Protocol) session between the vSmart controller and the branch devices is down.
- D
The branches are configured for hub-and-spoke topology, restricting direct branch-to-branch communication.
- E
Dynamic tunnels are disabled in the vManage policy for branch-to-branch communication.
Show answer and explanation
Correct answers: B, C, D, E
Explanation
Dynamic on-demand tunnels in Cisco SD-WAN are created based on routing and policy configurations. For these tunnels to form, IPsec encryption settings between devices must match, routing information must be shared via OMP, and policies should allow direct branch-to-branch communication. Additionally, the topology configuration (like hub-and-spoke) and explicit disabling of dynamic tunnels in vManage can also prevent tunnel formation. Understanding these factors ensures proper troubleshooting and configuration of Cisco SD-WAN dynamic tunnels.
- A. Incorrect.
Incorrect: While TLOC color differences affect reachability, they do not inherently prevent dynamic tunnels from forming. As long as TLOC reachability is established, dynamic tunnels can still form regardless of color differences.
- B. Correct.
Correct: IPsec encryption settings must match between devices for tunnels to be established. A mismatch in these settings will prevent dynamic tunnels from forming.
- C. Correct.
Correct: The OMP session is critical for sharing routing information and policy updates. If the OMP session between the vSmart controller and branch devices is down, dynamic tunnels cannot be established.
- D. Correct.
Correct: In a hub-and-spoke topology, direct branch-to-branch communication is restricted by design. This would prevent dynamic tunnels from forming between branches.
- E. Correct.
Correct: If dynamic tunnels are explicitly disabled in the overlay policies configured via vManage, branch-to-branch dynamic tunnels will not be created.