300-415 Question 183
Single answerAn enterprise is using Cisco SD-WAN to implement end-to-end segmentation across its network to isolate traffic between different business units. The network has multiple VPNs configured to enforce segmentation. The enterprise wants to ensure that each segment's traffic remains isolated while also allowing centralized management of security policies. What is a critical configuration step to achieve this?
- A
Associate traffic from each business unit with a specific VPN and configure policies to restrict inter-VPN communication.
- B
Enable OMP (Overlay Management Protocol) route redistribution across all VPNs to allow inter-VPN traffic routing.
- C
Assign a single VPN to all business units and use local ACLs to enforce segmentation.
- D
Configure TLOC extension between devices in different VPNs to ensure traffic isolation.
Show answer and explanation
Correct answer: A
Explanation
End-to-end segmentation in Cisco SD-WAN is achieved by logically isolating traffic using VPNs. Each business unit is assigned a specific VPN, and centralized policies are created to restrict inter-VPN communication, ensuring traffic isolation. This approach aligns with the principle of segmentation for secure, isolated traffic flows.
- A. Correct.
This is correct. Associating traffic with specific VPNs and restricting inter-VPN communication through policies ensures proper segmentation.
- B. Incorrect.
This is incorrect. Enabling OMP route redistribution across VPNs would violate the principle of traffic isolation by allowing inter-VPN routing.
- C. Incorrect.
This is incorrect. Using a single VPN for all business units does not achieve true segmentation, as traffic would not be logically separated.
- D. Incorrect.
This is incorrect. TLOC extension is used for redundancy and path optimization but does not enforce segmentation between VPNs.