300-415 Question 215
Select 3An enterprise is deploying Cisco SD-WAN with an application-aware enterprise firewall. The network administrator wants to enforce policies that allow only specific applications, such as Office 365 and Salesforce, while blocking others like peer-to-peer file sharing and social media. Which of the following configurations must the administrator apply to achieve this?
- A
Create an application-aware policy that identifies applications like Office 365 and Salesforce, and set their action to 'Permit'.
- B
Enable DPI (Deep Packet Inspection) in the Cisco SD-WAN data policies to classify application traffic accurately.
- C
Configure a zone-based firewall policy to block peer-to-peer and social media traffic based on IP addresses.
- D
Apply the application-aware firewall policy to the VPN interface bound to user traffic.
- E
Manually define port numbers and protocols for Office 365 and Salesforce traffic.
Show answer and explanation
Correct answers: A, B, D
Explanation
To enforce an application-aware enterprise firewall in Cisco SD-WAN, the administrator must use features like application-aware policies and DPI to classify and permit/block traffic based on application signatures. These policies must then be applied to the appropriate VPN interfaces to take effect. Relying on manual configurations like port numbers or IP addresses is not practical or scalable for modern, dynamic applications.
- A. Correct.
Creating an application-aware policy allows the administrator to define which applications are permitted, such as Office 365 and Salesforce, while blocking others.
- B. Correct.
DPI is critical for identifying application traffic accurately based on application signatures, not just ports or IP addresses.
- C. Incorrect.
While zone-based firewalls are useful, they are not the most efficient way to block application traffic in Cisco SD-WAN, as they rely on manual configurations like IP addresses and lack application awareness.
- D. Correct.
Applying the policy to the correct VPN interface ensures that the rules are enforced for the relevant traffic.
- E. Incorrect.
Manually defining port numbers and protocols is not recommended, as many applications, especially cloud-based ones like Office 365, use dynamic ports and protocols.