300-415 Question 223
Single answerA company is deploying Cisco SD-WAN and wants to enforce URL filtering to block access to social media websites. They have configured an appropriate URL filtering policy on the vManage controller and attached it to the relevant VPN. However, users are still able to access social media sites. What is the most likely reason for this issue?
- A
The URL filtering policy has not been activated on the vSmart controller.
- B
The DNS traffic for the users is bypassing the SD-WAN data policies.
- C
The URL filtering database is not synchronized with the vEdge devices.
- D
The URL filtering feature is not supported on the current software version of the vEdge devices.
Show answer and explanation
Correct answer: B
Explanation
URL filtering in Cisco SD-WAN relies on inspecting DNS traffic to enforce policies. If the DNS traffic is bypassing SD-WAN data policies (e.g., by being routed directly to an external DNS server), the URL filtering mechanism cannot take effect. Ensuring DNS traffic is routed through the SD-WAN fabric allows the URL filtering policies to function as intended.
- A. Incorrect.
The vSmart controller is responsible for policy distribution, not activation. URL filtering policies are distributed to the vEdge devices directly from vManage, and no manual activation on the vSmart controller is required.
- B. Correct.
If DNS traffic bypasses the SD-WAN data policies, the URL filtering mechanism cannot inspect or act on the DNS requests, allowing users to resolve and access blocked websites.
- C. Incorrect.
The synchronization of URL filtering databases occurs automatically as part of the SD-WAN solution. This is not the most likely cause of the issue described in the scenario.
- D. Incorrect.
URL filtering is supported on most Cisco SD-WAN platforms, assuming the devices are running a compatible software version. Lack of feature support is unlikely to be the issue in this scenario unless explicitly mentioned.