300-415 Exam Results

To establish a strict hub-and-spoke topology in Cisco SD-WAN for a specific VPN, such as VPN2, a control policy must be configured. This control policy dictates how traffic flows between sites, ensuring that all branch traffic is routed through the hub site.

Control Policy Components:

Site Lists: Define which sites are considered hubs and which are branches.

VPN Lists: Identify the VPNs to which the policy applies.

Control Policy: Use sequences to match routes and specify actions to accept or reject traffic based on the defined topology.

Policy Analysis:

Option A: Correctly defines site lists for hub sites (site-id 1-2) and creates a control policy that matches routes for VPN2, accepting routes from hub sites and rejecting routes from others. This ensures that traffic from branches (other sites) is only accepted if it routes through the hubs.

Other options either incorrectly define the site lists or do not properly match and set the routes to enforce the strict hub-and-spoke topology.

Policy Configuration:

policy

lists

vpn-list VPN2

vpn 2

site-list hub_sites

site-id 1-2

!

control-policy vpn_multi_topology

sequence 10

match route

site-list hub_sites

vpn-list VPN2

!

action accept

!

sequence 20

match route

vpn-list VPN2

!

action reject

!

default-action accept

When dealing with overlapping IP addresses in different branch sites, it's crucial to use NAT (Network Address Translation) to avoid IP conflicts and establish proper communication.

NAT Configuration:

Source NAT: This involves translating the source IP addresses of the packets as they leave a specific interface. This can help avoid IP conflicts by ensuring that the IP addresses used within the network are unique.

Data Policy: A data policy must be created that matches the source IP addresses and applies the NAT pool to translate these addresses.

Option A Analysis:

Policy Definition: The data policy Srvc_Plane_NAT includes a sequence that matches the source IP 10.0.0.1/32 and accepts the action to apply NAT using nat pool 1.

Interface Configuration: The interface ge0/0/0 is configured with the IP address 192.168.1.1/32 and is not shut down, ensuring it is active and can handle the NAT translation.