nerdexam
Cisco

300-415 · Question #177

An engineer must automate certificate signing through Cisco. Which vManage configuration achieves this task?

The correct answer is A. vpn 0 dns 208.67.222.222 primary allow-service dns allow-service sshd allow-service netconf. Automating certificate signing through Cisco requires configuring DNS services in VPN 0, as VPN 0 is the transport VPN responsible for overlay control plane communication, including reaching external services like DNS for certificate validation. The configuration must include…

Controller Deployment

Question

An engineer must automate certificate signing through Cisco. Which vManage configuration achieves this task?

Options

  • Avpn 0 dns 208.67.222.222 primary allow-service dns allow-service sshd allow-service netconf
  • Bvpn 0 allow-service dns allow-service sshd allow-service netconf
  • Cvpn 512 dns 208.67.222.222 primary allow-service dns allow-service sshd allow-service netconf
  • Dvpn 512 allow-service dns allow-service sshd allow-service netconf

How the community answered

(37 responses)
  • A
    89% (33)
  • B
    3% (1)
  • C
    5% (2)
  • D
    3% (1)

Why each option

Automating certificate signing through Cisco requires configuring DNS services in VPN 0, as VPN 0 is the transport VPN responsible for overlay control plane communication, including reaching external services like DNS for certificate validation. The configuration must include DNS server details and allow the necessary DNS service.

Avpn 0 dns 208.67.222.222 primary allow-service dns allow-service sshd allow-service netconfCorrect

To automate certificate signing through Cisco's public certificate authority (CA) or other external CAs, the vManage controller needs to be able to resolve DNS names for certificate revocation lists (CRLs) and other CA-related services. This connectivity is provided through VPN 0, which is the transport VPN. Configuring `dns 208.67.222.222 primary` and `allow-service dns` within `vpn 0` ensures that vManage can access the internet to perform DNS lookups required for automated certificate operations.

Bvpn 0 allow-service dns allow-service sshd allow-service netconf

This configuration is missing the specific DNS server IP address within VPN 0, which is necessary for vManage to resolve hostnames for certificate signing services.

Cvpn 512 dns 208.67.222.222 primary allow-service dns allow-service sshd allow-service netconf

VPN 512 is the management VPN, used for out-of-band management traffic, not for control plane communication or reaching external services like a public CA for certificate signing.

Dvpn 512 allow-service dns allow-service sshd allow-service netconf

This configuration incorrectly places the DNS service in VPN 512 and also omits the specific DNS server IP address, making it unsuitable for automated certificate signing that requires reaching external services via the transport VPN.

Concept tested: Cisco SD-WAN vManage automated certificate signing configuration

Source: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/security/ios-xe-17/sd-wan-security-cfg-guide-xe/m-security.html#concept_z4n_fyc_4gb

Topics

#vManage#Management VPN (VPN 0)#DNS configuration#Certificate automation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-415 Practice