300-415 Question 32
Single answerAn enterprise has deployed Cisco SD-WAN WAN Edge devices at multiple branch locations. The network administrator observes that data traffic between two branches is not being encrypted as expected. Upon investigation, the administrator discovers that IPsec tunnels are not being established between the WAN Edge devices. What could be a possible reason for this issue?
- A
The WAN Edge devices are not running the same software version.
- B
The WAN Edge devices do not have a valid Certificate Authority (CA) signed certificate.
- C
The OMP (Overlay Management Protocol) sessions between the WAN Edge devices are not established.
- D
The WAN Edge devices are configured with mismatched BGP AS numbers.
Show answer and explanation
Correct answer: B
Explanation
In Cisco SD-WAN, the establishment of IPsec tunnels between WAN Edge devices depends on successful mutual authentication, which is achieved using valid certificates signed by a trusted Certificate Authority. If the WAN Edge devices lack valid certificates, IPsec tunnel negotiation will fail, leading to unencrypted traffic between branch locations. Therefore, ensuring the presence of valid certificates is critical for secure data plane operations.
- A. Incorrect.
The software version mismatch could cause certain feature discrepancies, but it will not directly prevent the establishment of IPsec tunnels, as long as compatibility is maintained.
- B. Correct.
IPsec tunnels in Cisco SD-WAN require valid certificates for device authentication. If the WAN Edge devices do not have valid CA-signed certificates, IPsec tunnel establishment will fail.
- C. Incorrect.
OMP is responsible for the exchange of routing information between WAN Edge devices. While it is crucial for routing, it does not directly impact the authentication required for IPsec tunnel establishment.
- D. Incorrect.
Mismatched BGP AS numbers may cause routing issues but do not prevent IPsec tunnels from being established as IPsec is independent of BGP configuration.