300-415 · Question #376
Which configuration change allows direct internet access at the branch site for YouTube traffic?
The correct answer is C. policy data-policy DPI vpn-list vpn10 sequence 10 match app-list YouTube ! action count Youtube nat vpn 0 ! default-action accept ! lists vpn-list vpn10. To enable direct internet access (DIA) for specific application traffic like YouTube at a branch site in Cisco SD-WAN, a data policy must be configured to match the application and apply a nat vpn 0 action, which directs traffic to the internet VPN (VPN 0).
Question
Options
- Apolicy data-policy DPI vpn-list vpn10 sequence 10 match app-list YouTube ! action drop count YouTube ! default-action accept ! lists vpn-list vpn10
- Bpolicy data-policy DPI vpn-list vpn10 sequence 10 match app-list YouTube ! action drop count YouTube ! default-action accept ! lists vpn-list vpn10
- Cpolicy data-policy DPI vpn-list vpn10 sequence 10 match app-list YouTube ! action count Youtube nat vpn 0 ! default-action accept ! lists vpn-list vpn10
- Dpolicy data-policy DPI vpn-list vpn10 sequence 10 match app-list YouTube ! action count Youtube nat vpn 0 ! default-action accept ! lists vpn-list vpn10
How the community answered
(33 responses)- A3% (1)
- B6% (2)
- C76% (25)
- D15% (5)
Why each option
To enable direct internet access (DIA) for specific application traffic like YouTube at a branch site in Cisco SD-WAN, a data policy must be configured to match the application and apply a `nat vpn 0` action, which directs traffic to the internet VPN (VPN 0).
This policy is configured to `action drop` YouTube traffic, which would block it, not allow direct internet access.
Similar to A, this policy is configured to `action drop` YouTube traffic, which prevents direct internet access.
This configuration correctly implements direct internet access for YouTube traffic by matching the `app-list YouTube` and then applying the `action nat vpn 0`. The `nat vpn 0` command instructs the device to perform NAT for the matched traffic using the internet-facing VPN (VPN 0), thus allowing it to exit directly to the internet from the branch.
This configuration is identical to C and would also be correct, as it specifies `action nat vpn 0` for YouTube traffic, enabling direct internet access.
Concept tested: SD-WAN Direct Internet Access (DIA) policy
Source: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/sdwan-xe-gs-book/m-dia.html
Topics
Community Discussion
No community discussion yet for this question.