300-415 Question 247
Select 3An enterprise has implemented Cisco SD-WAN with Secure Internet Gateway (SIG) integration to secure direct internet access for branch offices. The network administrator notices that some traffic is not being inspected by the SIG as intended. What must the administrator verify to ensure proper SIG traffic redirection?
- A
The SIG tunnel interface is correctly configured on the SD-WAN edge devices.
- B
Security policies are applied to direct traffic to the SIG.
- C
The DNS server configuration points to the SIG for all name resolutions.
- D
The SIG endpoints are reachable from the branch offices.
- E
The SD-WAN edge devices have an active IPsec tunnel with the SIG.
Show answer and explanation
Correct answers: A, B, D
Explanation
To ensure proper traffic inspection by the Secure Internet Gateway (SIG) in a Cisco SD-WAN deployment, it is crucial to have a correctly configured SIG tunnel interface, apply security policies to route traffic to the SIG, and verify SIG endpoint reachability. DNS configuration and IPsec tunnels are not necessary for SIG integration, as the SIG focuses on traffic inspection, and the connectivity method can vary depending on the deployment.
- A. Correct.
The SIG tunnel interface must be properly configured on SD-WAN edge devices to redirect traffic to the SIG for inspection. Without this, the traffic cannot reach the SIG.
- B. Correct.
Security policies in Cisco SD-WAN define how traffic is routed and inspected. If these policies are not configured to redirect traffic to the SIG, the traffic will bypass the SIG.
- C. Incorrect.
DNS server configuration does not need to point to the SIG, as SIG integration is focused on inspecting traffic rather than resolving domain names.
- D. Correct.
The SIG endpoints must be reachable from the branch offices to allow traffic redirection and inspection. If the endpoints are unreachable, the integration will fail.
- E. Incorrect.
IPsec tunnels are not mandatory for all SIG integrations. Some SIG deployments use other mechanisms, such as GRE tunnels, to connect to the SD-WAN fabric.