300-415 · Question #121
Refer to the exhibit. Which configuration configures IPsec tunnels in active and standby?
The correct answer is C. vpn 1 service netsvc1 interface ipsec1 ipsec2 from-vsmart lists vpn-list 1 vpn 0. To configure IPsec tunnels in an active and standby configuration within a service VPN, a centralized data policy should specify multiple interfaces for the service.
Question
Options
- Avpn-list 1 count ServicePSec1_275676046 from-vsmart lists vpn-list 1 vpn 0 service netsvc1 interface ipsec1 ipsec2
- Bvpn-list 1 vpn 0 service netsvc1 interface ipsec1 ipsec2 from-vsmart lists vpn-list 0 vpn 0
- Cvpn 1 service netsvc1 interface ipsec1 ipsec2 from-vsmart lists vpn-list 1 vpn 0
- Dvpn 0 service netsvc1 interface ipsec1 ipsec2 from-vsmart lists vpn-list 0 vpn 0
How the community answered
(43 responses)- A7% (3)
- B9% (4)
- C81% (35)
- D2% (1)
Why each option
To configure IPsec tunnels in an active and standby configuration within a service VPN, a centralized data policy should specify multiple interfaces for the service.
This option contains `vpn-list` and `count` parameters that are not part of the standard command to configure active/standby IPsec tunnels within a service VPN, and its syntax is inconsistent.
This option uses `vpn 0`, which is the transport VPN, typically for control plane and underlay connectivity, not directly for configuring active/standby application tunnels within a service VPN.
The configuration `vpn 1 service netsvc1 interface ipsec1 ipsec2` within a centralized data policy allows specifying multiple IPsec interfaces (e.g., `ipsec1` and `ipsec2`) for a particular service VPN (e.g., VPN 1). This is the mechanism used to enable redundancy, allowing for active-standby or active-active IPsec tunnel deployments depending on the path preference and policy logic.
This option also uses `vpn 0`, indicating the transport VPN, which is incorrect for configuring active/standby IPsec tunnels for a user service VPN.
Concept tested: SD-WAN centralized data policy for IPsec redundancy (active/standby)
Source: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/sdwan-xe-gs-book/m-centralized-data-policy.html
Topics
Community Discussion
No community discussion yet for this question.