300-415 Question 181
Select 3A financial organization is deploying Cisco SD-WAN to ensure secure and isolated communication between their accounting, HR, and IT departments. They want to implement end-to-end segmentation to achieve this isolation across their entire network. What steps must be taken to configure end-to-end segmentation in Cisco SD-WAN?
- A
Define VPNs for each department with unique VPN IDs in the vManage configuration.
- B
Enable OSPF or BGP within each VPN to allow inter-VPN communication for better performance.
- C
Apply central policies in vManage to control traffic flow between VPNs and enforce segmentation rules.
- D
Map the VPNs to specific data plane tunnels using TLOCs to maintain traffic isolation.
- E
Configure service-side policies to allow shared services access, such as DNS or Active Directory, across defined VPNs.
Show answer and explanation
Correct answers: A, C, D
Explanation
To configure end-to-end segmentation in Cisco SD-WAN, you must define VPNs for each segment, enforce isolation rules using central policies, and ensure that traffic remains isolated through proper TLOC mapping. These steps collectively ensure that traffic from different segments (such as accounting, HR, and IT) remains secure and separated throughout the network.
- A. Correct.
Defining VPNs with unique VPN IDs is a fundamental step in establishing segmentation in Cisco SD-WAN. Each VPN represents an isolated segment of the network.
- B. Incorrect.
Enabling OSPF or BGP between VPNs contradicts the purpose of segmentation, as it would allow unrestricted communication between segments.
- C. Correct.
Centralized policies in vManage help enforce segmentation rules by controlling traffic flow and ensuring VPN isolation across the network.
- D. Correct.
Mapping VPNs to specific TLOCs ensures that each segment's traffic is routed through designated data plane tunnels, maintaining strict isolation.
- E. Incorrect.
Service-side policies for shared services like DNS are optional and must be carefully controlled to avoid breaking the segmentation model. This step is not required for basic end-to-end segmentation.