Where would you configure a Global VPN community between gateways on different CMAs?

Anastasia B.Apr 4, 2026

CMA Objects is correct. In a Multi-Domain environment, a Global VPN community that spans gateways managed by different CMAs must be configured at the Global level within the CMA Objects, because that is the only scope that has visibility across all the Customer Management Addresses and can define the trust and community membership that crosses those domain boundaries.

Grace U.Oct 17, 2025

The answer here is C, CMA Objects, and once you see the reasoning it sticks for good. In a Multi-Domain environment, gateways live inside their own CMA and are not directly visible at the global level, so you cannot simply point to individual gateway objects when building a community that crosses CMA boundaries. The Global SmartDashboard works with CMA Objects as the representatives of those domains, and that is where you define the Global VPN community so the system knows which CMAs are participating. Think of it this way: the CMA is the container, and the global policy has to reference the container rather than what is inside it, because from the global perspective the container is the addressable unit. If you picked B and went looking for individual gateway objects at the global layer, you would not find them there, which is exactly the kind of trap these questions are designed to set.

Samuel O.Oct 6, 2025

C is right. When you have gateways managed by separate CMAs in an MDSM environment, the VPN community configuration lives at the CMA object level because that is where the trust and policy context for each managed domain gets established, so reaching across CMA boundaries for a Global VPN requires you to wire it up there first.

Anjali D.Apr 23, 2026

Our group was pretty split on this one at first, with a few people going for B thinking you would just set it up inside the gateway objects themselves, but once someone pointed out that individual CMAs have no visibility into each other's gateways, the answer snapped into place as C. Global VPN communities that span multiple CMAs have to live at the CMA object level in the Global SmartDashboard because that is the only layer with the scope to reference gateways across different management domains. Configuring it anywhere lower, like at the gateway or VPN domain object level, would keep you siloed inside a single CMA and you would never bridge across domains that way. When I sat the exam last spring I actually second-guessed myself on this one for a minute before remembering how the MDS hierarchy works, and once I thought about where global policy actually gets pushed from, C was the only logical place it could be. Anyone else run into this on a practice set and want to share how you reasoned it out?

Eitan E.May 2, 2026

Correct, C is the right pick. In an MDSM environment the CMA Object is where you stitch together the inter-CMA VPN community because each CMA manages its own gateways, and the Global Policy layer needs a representation at the CMA level to coordinate the trust and encryption domains across those separate management domains.

Dejan C.Apr 9, 2026

D, because the VPN domain scoping is what ties cross-CMA gateways into a shared community.

Yusuf A.Apr 19, 2026

Has to be A, CA objects handle cross-CMA trust for global VPN.