300-415: Implementing Cisco Catalyst SD-WAN SolutionsDemo

The BFD multiplier specifies how many consecutive BFD packets may be missed before the path is considered down. For Cisco SD-WAN application-aware routing, the multiplier is 6.

A TLS forward proxy creates two distinct sessions—one between the client and the proxy, and one between the proxy and the server—before it can proxy TLS negotiation, apply decryption policy, and inspect the traffic.

Cisco SD-WAN vManage requires the vBond orchestrator’s IP address or DNS name in its system configuration to establish the control-plane connection. Matching Enterprise Root CA certificates, VPN0 reachability, and organization names do not replace the required vBond address configuration.

Cisco SD-WAN Manager (vManage) scales through a cluster of vManage servers. Cluster members share information and distribute management functions and workload, allowing the deployment to support a larger network than a standalone vManage instance.

The route retains the BGP path learned from the right-side service network, 20 104. When an OMP route is redistributed into BGP, the configured overlay-as is prepended to the BGP AS path; the eBGP advertisement from VE100 then prepends VE100’s local AS, 100. The resulting AS-PATH is 100 10666 20 104.

Cloud OnRamp for Colocation supports partners and vendors that lack Cisco SD-WAN yet need connectivity to customer environments without deploying Cisco SD-WAN routing appliances at their own sites.

Cisco SD-WAN OMP routes, also called vRoutes, carry prefix information learned from the local site by a WAN Edge router. TLOC routes describe transport locations, whereas service routes advertise available network services. Cisco OMP route advertisements

TLOC entries learned through OMP contain the transport color attribute. show omp tlocs lists the TLOCs learned by the local router from the Cisco vSmart Controller, including their colors.

An app-route policy implements application-aware routing. It uses SLA classes based on measured tunnel loss, latency, and jitter to select paths that meet application performance requirements.

Cisco Catalyst SD-WAN BFD runs over data-plane tunnels and uses periodic Hello probes to monitor tunnel liveness while measuring packet loss, latency, and jitter for application-aware routing. Cisco: BFD protocol for Cisco SD-WAN

Cisco SD-WAN vEdge devices support enterprise firewall capabilities and Cisco Umbrella DNS Security integration. Snort intrusion prevention, Cisco AMP with AMP Threat Grid, and URL filtering are not vEdge advanced-security capabilities.

For Cisco WAN Edge SNMPv3 configuration, the username specified by the snmp user command supports a string length of 1 through 32 characters.

Cisco IOS XE SD-WAN supports Cisco ISR 4000 Series Integrated Services Routers and Cisco ASR 1000 Series Aggregation Services Routers. Cisco’s device compatibility matrix lists supported models in both platform families for IOS XE SD-WAN releases.

Cisco SD-WAN’s application-aware firewall uses application detection to provide application visibility and granular control, including the ability to identify Layer 7 applications and apply traffic-blocking policies by application or application family.

Cisco SD-WAN application-aware routing uses an SLA class with a latency threshold, such as 50 ms, to select a compliant transport path for matching voice traffic. Application-aware routing is a centralized data-policy capability.

Cisco Catalyst SD-WAN defines the WAN Edge UDP port offset as a value from 0 through 19; offset 0 is the default. The same UDP port-offset range applies to IPsec tunnel encapsulation between WAN Edge routers.

On Cisco IOS XE Catalyst SD-WAN cEdge devices, m in show ip route vrf output denotes an OMP route; therefore, the default route is learned through OMP. The IOS XE show ip route vrf command format and interface naming also identify the routing table as originating from a cEdge router. Cisco documentation defines m as OMP in this route display format.

A centralized data policy is applied to a site list with data-policy policy-name from-service when it must process traffic leaving the service/LAN side toward the WAN. DATA-POLICY-TO-vEdges is the defined data-policy name, and from-service ensures the proxy servers’ source traffic is evaluated for the configured accept and nat use-vpn 0 action.

When a TLS decryption policy applies, the Cisco SD-WAN TLS proxy sends the client Hello packet to Unified Threat Defense (UTD) so that UTD can return a decryption verdict, such as decrypt, do-not-decrypt, or drop.

Cisco SD-WAN requires the IPsec rekey timer to be at least twice the OMP graceful restart timer. A 24-hour graceful-restart value therefore requires an IPsec rekey timer of at least 48 hours.

Cisco SD-WAN uses show policy from-vsmart on a vEdge router to display and verify policy received from the vSmart controller.

A vEdge Cloud router is activated in the Cisco SD-WAN overlay by supplying its chassis number and the token obtained from Cisco SD-WAN Manager (vManage). The required command syntax is request vedge-cloud activate chassis-number <number> token <token>.