300-415 Question 221
Single answerA company has implemented Cisco SD-WAN in its network and wants to enforce URL filtering to block access to specific categories of websites such as 'Social Media' during business hours. The administrator configures a centralized policy with URL filtering enabled, applies it to the appropriate data policies, and activates it. However, users are still able to access restricted websites. Which of the following could be the reason for this issue?
- A
The URL filtering policy has not been enabled on the branch vEdge routers.
- B
The centralized policy is applied only to control plane traffic, not data plane traffic.
- C
The URL filtering feature requires an additional license that has not been installed.
- D
The DNS resolution for the blocked URLs is bypassing the SD-WAN data policies.
Show answer and explanation
Correct answer: C
Explanation
Cisco SD-WAN's URL filtering feature requires a security license to be enabled. Without the necessary license, even if the URL filtering policy is correctly configured and applied, it will not function. This is a common issue when implementing URL filtering in SD-WAN environments.
- A. Incorrect.
Incorrect. URL filtering policies are enforced on the vEdge devices as part of the data plane policies, so this is not the issue.
- B. Incorrect.
Incorrect. Centralized policies with URL filtering are applied to data plane traffic, not control plane traffic.
- C. Correct.
Correct. URL filtering in Cisco SD-WAN requires the appropriate security license to function. If the license is not installed, the feature will not work.
- D. Incorrect.
Incorrect. URL filtering works by inspecting HTTP or HTTPS traffic, not DNS resolution. DNS bypass would not affect the URL filtering enforcement.