300-415 Question 212
Select 3An organization has deployed Cisco SD-WAN with an application-aware enterprise firewall policy to restrict access to specific applications. The administrator notices that users are still able to access restricted applications despite the policy being applied. What should the administrator check to resolve the issue?
- A
Verify if the application signatures database is up to date in the vManage.
- B
Ensure that the application-aware firewall policy is applied to the correct VPN or site list.
- C
Check if the firewall rule allows traffic from internal subnets to external applications.
- D
Confirm that the traffic is being classified correctly by the DPI (Deep Packet Inspection) engine.
- E
Enable logging on the policy to troubleshoot traffic behavior.
Show answer and explanation
Correct answers: A, B, D
Explanation
To ensure the application-aware enterprise firewall functions correctly in Cisco SD-WAN, the administrator must verify that application signatures are up to date, the policy is applied to the correct scope (VPN or site list), and the DPI engine is classifying traffic accurately. These steps ensure that the firewall can identify and block restricted applications effectively. While enabling logging can help diagnose issues, it is not a direct resolution to the problem.
- A. Correct.
If the application signatures database is outdated, the firewall may not correctly identify and block applications, leading to policy misbehavior.
- B. Correct.
The policy must be applied to the correct VPN or site list; otherwise, it will not enforce the intended restrictions.
- C. Incorrect.
While this checks general traffic flow, it is unrelated to the specific issue of restricted applications being accessible.
- D. Correct.
If the DPI engine is not classifying traffic correctly, the application-aware firewall cannot enforce policies accurately.
- E. Incorrect.
Enabling logging is useful for troubleshooting but does not directly resolve the issue of policy misapplication or incorrect classification.