300-415 Question 185
Single answerA company has deployed a Cisco SD-WAN solution and wants to use VPN segmentation to isolate traffic between departments. The IT team has configured separate VPNs for HR, Finance, and Engineering. However, some Engineering users need restricted access to Finance resources for specific applications. Which solution should the IT team implement to achieve this requirement while maintaining VPN segmentation?
- A
Configure route leaking between the Engineering VPN and Finance VPN using a centralized control policy.
- B
Enable direct communication between the Engineering VPN and Finance VPN by configuring a unified VPN.
- C
Use TLOC extension to provide shared access between the Engineering and Finance VPNs.
- D
Apply a localized data policy to block all traffic between the Engineering VPN and Finance VPN except for specific applications.
Show answer and explanation
Correct answer: A
Explanation
VPN segmentation in Cisco SD-WAN allows for isolating traffic by separating it into distinct VPNs. To selectively share routes between VPNs while maintaining segmentation, route leaking via a centralized control policy is the recommended approach. This ensures Engineering users can access specific Finance resources without compromising the isolation between other traffic.
- A. Correct.
Configuring route leaking with a centralized control policy allows selective sharing of routes between VPNs, enabling restricted access between specific departments or applications. This approach maintains VPN segmentation while meeting the requirement.
- B. Incorrect.
Configuring a unified VPN would remove segmentation between all VPNs, defeating the purpose of isolating traffic between departments.
- C. Incorrect.
TLOC extension is used to extend transport circuits, not for managing inter-VPN communication or segmentation.
- D. Incorrect.
A localized data policy operates at the edge device level and cannot handle the centralized requirement for route sharing between VPNs. It is also not scalable for multi-site deployments.