nerdexam
Cisco

300-415 · Question #350

A customer has two branch sites with overlapping IPs. How must the data policy be configured to establish communication between the sites and server to avoid overlapping?

The correct answer is A. policy data-policy Srvc_Plane_NAT vpn-list VPN1 sequence 10 match source-ip 10.0.0.1/32 ! action accept nat pool 1 ! ! default-action accept ! To resolve overlapping IP addresses between branch sites, a service-side NAT data policy using a NAT pool must be applied to translate the source IP before traffic traverses the SD-WAN overlay.

Policies

Question

A customer has two branch sites with overlapping IPs. How must the data policy be configured to establish communication between the sites and server to avoid overlapping?

Exhibit

300-415 question #350 exhibit

Options

  • Apolicy data-policy Srvc_Plane_NAT vpn-list VPN1 sequence 10 match source-ip 10.0.0.1/32 ! action accept nat pool 1 ! ! default-action accept !
  • Bpolicy data-policy Srvc_Plane_NAT vpn-list VPN2 sequence 10 match source-ip 10.0.0.1/32 ! action accept nat pool 1 ! ! default-action accept ! vpn 2 interface ge0/0/0 ip address 192.168.1.1/32 no shutdown
  • Cpolicy data-policy Srvc_Plane_NAT vpn-list VPN2 sequence 10 match source-ip 10.0.0.1/32 ! action accept nat pool 1 ! ! default-action accept ! vpn2 interface natpool1 ip address 192.168.1.1/32 no shutdown
  • Dpolicy data-policy Srvc_Plane_NAT vpn-list VPN1 sequence 10 match source-ip 10.0.0.1/32 ! action accept nat use-vpn 0 ! ! default-action accept !

How the community answered

(57 responses)
  • A
    82% (47)
  • B
    5% (3)
  • C
    2% (1)
  • D
    11% (6)

Why each option

To resolve overlapping IP addresses between branch sites, a service-side NAT data policy using a NAT pool must be applied to translate the source IP before traffic traverses the SD-WAN overlay.

Apolicy data-policy Srvc_Plane_NAT vpn-list VPN1 sequence 10 match source-ip 10.0.0.1/32 ! action accept nat pool 1 ! ! default-action accept !Correct

Option A correctly configures a data policy that matches the overlapping source IP 10.0.0.1/32 in VPN1 and applies 'nat pool 1' to translate it, resolving the address conflict. Using a NAT pool at the service side ensures that traffic from both sites appears with distinct translated addresses, preventing routing ambiguity across the overlay.

Bpolicy data-policy Srvc_Plane_NAT vpn-list VPN2 sequence 10 match source-ip 10.0.0.1/32 ! action accept nat pool 1 ! ! default-action accept ! vpn 2 interface ge0/0/0 ip address 192.168.1.1/32 no shutdown

Option B incorrectly appends a VPN interface configuration block with a static IP address inside the data policy, which is not valid syntax for a data policy and would not resolve the overlap.

Cpolicy data-policy Srvc_Plane_NAT vpn-list VPN2 sequence 10 match source-ip 10.0.0.1/32 ! action accept nat pool 1 ! ! default-action accept ! vpn2 interface natpool1 ip address 192.168.1.1/32 no shutdown

Option C contains invalid syntax - 'vpn2' (no space) and 'interface natpool1' are not valid configuration constructs within a data policy block.

Dpolicy data-policy Srvc_Plane_NAT vpn-list VPN1 sequence 10 match source-ip 10.0.0.1/32 ! action accept nat use-vpn 0 ! ! default-action accept !

Option D uses 'nat use-vpn 0', which is the syntax for Direct Internet Access NAT to VPN 0, not for resolving overlapping IPs between two service-side VPNs.

Concept tested: Service-side NAT data policy for overlapping IP resolution

Source: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/policies/ios-xe-17/policies-book-xe/nat-for-traffic-flows.html

Topics

#SD-WAN Data Policy#NAT#IP Overlap#Policy Configuration

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-415 Practice