300-415 Question 196
Select 4A company is deploying Cisco SD-WAN at multiple branch locations. The IT team needs to configure Direct Internet Access (DIA) for these branches to allow local internet breakout for SaaS applications and reduce WAN traffic. They want to ensure the configuration is secure while meeting performance requirements. Which steps should the IT team take to configure DIA effectively?
- A
Configure a localized data policy to allow internet-bound traffic to exit directly from the branch sites.
- B
Enable Application-Aware Routing to monitor SaaS application performance and dynamically route traffic via the optimal path.
- C
Use NAT on the branch edge routers to translate local private IP addresses to public IP addresses for internet-bound traffic.
- D
Disable BFD (Bidirectional Forwarding Detection) for the direct internet link to reduce overhead and enhance performance.
- E
Configure a VPN specifically for internet traffic and apply a firewall policy to inspect and secure the traffic.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To configure Direct Internet Access (DIA) in Cisco SD-WAN, a combination of data policies, NAT, Application-Aware Routing, and security measures (like firewalls) is required. Localized data policies route internet-bound traffic directly from branches. NAT translates private IPs to public IPs for internet compatibility. Application-Aware Routing ensures SaaS applications perform well. Additionally, securing this traffic with firewalls is critical. Disabling essential features like BFD would compromise reliability and is not recommended.
- A. Correct.
Correct. A localized data policy is necessary for identifying and routing internet-bound traffic directly to the internet from branch sites, bypassing the central data center.
- B. Correct.
Correct. Application-Aware Routing ensures optimal performance for SaaS applications by selecting the best-performing path, which is crucial for DIA configurations.
- C. Correct.
Correct. NAT is required to translate private IP addresses used within the branch network to public IP addresses for internet-bound traffic.
- D. Incorrect.
Incorrect. Disabling BFD is not recommended, as it provides fast failure detection which is critical for ensuring reliability in SD-WAN deployments.
- E. Correct.
Correct. Creating a dedicated VPN for internet traffic and applying firewall policies ensures that internet-bound traffic is secured and inspected properly.