300-415 Question 234
Select 2You are a network engineer deploying Cisco SD-WAN in an enterprise environment. The organization has implemented Cisco TrustSec for secure segmentation based on Security Group Tags (SGTs). How can Cisco SD-WAN integrate with TrustSec to ensure end-to-end segmentation across the WAN?
- A
By mapping SGTs to VPNs in the SD-WAN overlay to maintain segmentation
- B
By propagating SGTs across the SD-WAN fabric using IPsec tunnels
- C
By importing SGTs into vManage and applying them as policies on WAN edge devices
- D
By using SGTs to classify traffic and enforce policies within the SD-WAN data plane
- E
By configuring OMP (Overlay Management Protocol) to natively support SGT propagation
Show answer and explanation
Correct answers: A, D
Explanation
Cisco SD-WAN integrates with Cisco TrustSec by leveraging mechanisms such as mapping SGTs to VPNs for segmentation and using SGTs to classify and enforce security policies within the SD-WAN data plane. These methods ensure that TrustSec's secure segmentation is maintained across the WAN. However, SGTs are not propagated directly through IPsec or OMP, and vManage does not directly import SGTs for configuration.
- A. Correct.
Correct: Mapping SGTs to VPNs in the SD-WAN overlay ensures that segmentation policies defined by TrustSec are preserved throughout the SD-WAN fabric.
- B. Incorrect.
Incorrect: While IPsec tunnels are used in SD-WAN for secure communication, they do not inherently propagate SGTs across the fabric.
- C. Incorrect.
Incorrect: Cisco vManage does not directly import SGTs. Policies related to SGTs can be configured through other means, but this option does not reflect an accurate mechanism.
- D. Correct.
Correct: SGTs are used to classify traffic and enforce security policies within the SD-WAN data plane, ensuring TrustSec segmentation is maintained.
- E. Incorrect.
Incorrect: OMP does not natively support the propagation of SGTs. SGTs are typically mapped to SD-WAN constructs like VPNs or policies.