300-415 Question 180
Select 3A company is deploying Cisco SD-WAN to support multiple departments, each with strict security and traffic isolation requirements. The IT team needs to implement end-to-end segmentation to ensure departmental traffic remains isolated across the SD-WAN fabric. Which of the following actions are required to configure end-to-end segmentation in this environment?
- A
Define separate VPNs for each department to isolate their traffic.
- B
Configure centralized policies to enforce traffic segmentation across the SD-WAN fabric.
- C
Configure TLOC extensions between all edge routers to support segmentation.
- D
Assign data traffic from each department to specific VPNs at the branch sites.
- E
Enable NAT on all edge routers to support segmentation.
Show answer and explanation
Correct answers: A, B, D
Explanation
End-to-end segmentation in Cisco SD-WAN is achieved by defining separate VPNs for traffic isolation, assigning traffic to the appropriate VPNs, and using centralized policies to enforce segmentation rules across the SD-WAN fabric. These configurations ensure that traffic from different departments or use cases remains isolated and secure throughout the network.
- A. Correct.
Defining separate VPNs (or VRFs) for each department ensures logical traffic isolation, which is a core component of end-to-end segmentation in Cisco SD-WAN.
- B. Correct.
Centralized policies are necessary to enforce segmentation rules across the SD-WAN fabric and ensure proper handling of traffic across different VPNs.
- C. Incorrect.
TLOC extensions are used for extending transport reachability between WAN Edge devices but are not directly related to traffic segmentation.
- D. Correct.
Assigning data traffic to specific VPNs at branch sites ensures traffic is mapped correctly to the corresponding segment, maintaining isolation.
- E. Incorrect.
Enabling NAT is not required for segmentation; NAT is used for address translation and does not contribute to end-to-end traffic isolation.