300-415 Question 129
Select 2A network engineer is deploying a Cisco SD-WAN solution. The underlay network consists of multiple Internet Service Providers (ISPs) and a private MPLS circuit, providing transport for the overlay network. During the deployment, the engineer notices that some of the edge devices are unable to establish DTLS/TLS connections to the vSmart controllers. What could be the possible reason for this connectivity issue?
- A
The underlay network does not have proper DNS resolution for the vSmart controllers.
- B
The edge devices are not configured with the correct organization name in their device configuration.
- C
A firewall in the underlay network is blocking UDP port 12346 or TCP port 23456.
- D
BGP is not configured on the underlay network to advertise transport IP addresses.
- E
The overlay network is using a mismatched encryption key for secure communication.
Show answer and explanation
Correct answers: A, C
Explanation
For Cisco SD-WAN, underlay connectivity is essential to establish an overlay network. DTLS/TLS connections between edge devices and vSmart controllers rely on proper DNS resolution and open firewall ports in the underlay. If DNS is misconfigured or specific ports like UDP 12346 are blocked, the devices will fail to establish the required connections. Configuration errors like a mismatched organization name or encryption key affect the overlay but not the initial underlay connectivity.
- A. Correct.
Correct. DNS resolution is required in the underlay network to resolve the vSmart controller's hostname to its IP address, which is critical for establishing connectivity.
- B. Incorrect.
Incorrect. While the organization name is critical for authentication, it does not directly impact the ability to establish DTLS/TLS connections if underlay connectivity is already failing.
- C. Correct.
Correct. Firewalls in the underlay network must allow traffic on specific ports (UDP 12346 and TCP 23456) for DTLS/TLS communication between edge devices and controllers.
- D. Incorrect.
Incorrect. BGP configuration in the underlay is not mandatory for SD-WAN connectivity as long as the transport IPs are reachable.
- E. Incorrect.
Incorrect. Encryption key mismatches affect overlay communication security but do not prevent the establishment of basic DTLS/TLS connections.