Cisco
300-415 · Question #441
300-415 Question #441: Real Exam Question with Answer & Explanation
The correct answer is D: sequence 20 match destination-port 80 443 destination-data-prefix-list GOVERNMENT-WEBSITES ! action accept nat use-vpn 0. To admit web browsing traffic to government websites for DIA, the policy must match destination ports 80 and 443 against a destination prefix list representing government IP ranges, then NAT the traffic out VPN 0.
Policies
Question
Refer to the exhibit. An engineer is modifying an existing data policy for DIA in VPN 23. Web browsing traffic toward government websites must be admitted for DIA. All other traffic must follow the regular routing path. Which policy sequence meets these requirements when appended to the existing configuration?
Options
- Asequence 20 match source-data-prefix-list GOVERNMENT-WEBSITES ! action accept nat use-vpn 0
- Bsequence 20 match destination-port 80 443 source-data-prefix-list GOVERNMENT-WEBSITES ! action accept nat use-vpn 0
- Csequence 20 match source-port 80 443 destination-data-prefix-list GOVERNMENT-WEBSITES ! action accept nat use-vpn 0 nat fallback
- Dsequence 20 match destination-port 80 443 destination-data-prefix-list GOVERNMENT-WEBSITES ! action accept nat use-vpn 0
Explanation
To admit web browsing traffic to government websites for DIA, the policy must match destination ports 80 and 443 against a destination prefix list representing government IP ranges, then NAT the traffic out VPN 0.
Common mistakes.
- A. Using 'source-data-prefix-list GOVERNMENT-WEBSITES' incorrectly treats government website addresses as traffic sources rather than destinations, so outbound browsing traffic to government sites would not be matched.
- B. Using 'source-data-prefix-list GOVERNMENT-WEBSITES' has the same source-vs-destination error as option A; government websites are destinations of user traffic, not the source.
- C. 'source-port 80 443' matches traffic where the source port is 80 or 443, which applies to server responses rather than client web browsing requests, causing the policy to miss outbound user traffic.
Concept tested. SD-WAN DIA data policy with destination prefix and port matching
Topics
#SD-WAN Data Policy#Direct Internet Access (DIA)#Policy Match Conditions#Data Prefix List
Community Discussion
No community discussion yet for this question.