300-415 Question 182
Select 3You are configuring end-to-end segmentation in a Cisco SD-WAN deployment to isolate traffic from different business units. The network design includes two segments: 'Finance' and 'HR.' Each segment requires strict separation of traffic, including at the data plane level. How can you ensure proper segmentation throughout the SD-WAN fabric?
- A
Assign VPN identifiers to each segment and configure TLOCs to map traffic to the appropriate VPN.
- B
Use application-aware routing to dynamically route traffic based on segment-specific SLAs.
- C
Configure centralized policies to restrict inter-VPN communication between 'Finance' and 'HR' segments.
- D
Tag data traffic in each segment with a specific DSCP marking to ensure separation.
- E
Enable segmentation-aware OMP routes to propagate segment-specific routes across the SD-WAN fabric.
Show answer and explanation
Correct answers: A, C, E
Explanation
To achieve end-to-end segmentation in Cisco SD-WAN, you must configure VPNs with unique identifiers for each segment, implement centralized policies to enforce isolation, and use segmentation-aware OMP routes to propagate segment-specific routing information. These configurations ensure both control plane and data plane isolation, fulfilling the requirements for strict traffic segregation between business units like 'Finance' and 'HR.'
- A. Correct.
Assigning VPN identifiers (e.g., VPN 10 for Finance and VPN 20 for HR) is a fundamental step for creating isolated data plane traffic for each segment. TLOC configuration ensures that traffic is properly routed to the corresponding VPN.
- B. Incorrect.
Application-aware routing is used to optimize traffic paths based on performance metrics, but it does not enforce segmentation or traffic isolation.
- C. Correct.
Centralized policies are essential to restrict communication between VPNs and enforce segmentation rules. Without these policies, inter-VPN traffic could potentially traverse the SD-WAN fabric.
- D. Incorrect.
DSCP markings are used for QoS and prioritization, not for enforcing segmentation. They do not ensure traffic isolation within the SD-WAN fabric.
- E. Correct.
Segmentation-aware OMP routes are necessary to propagate segment-specific route information, ensuring that routes for each segment remain isolated throughout the fabric.