nerdexam
Cisco

300-415 · Question #441

Refer to the exhibit. An engineer is modifying an existing data policy for DIA in VPN 23. Web browsing traffic toward government websites must be admitted for DIA. All other traffic must follow the…

The correct answer is D. sequence 20 match destination-port 80 443 destination-data-prefix-list GOVERNMENT-WEBSITES ! action accept nat use-vpn 0. To admit web browsing traffic to government websites for DIA, the policy must match destination ports 80 and 443 against a destination prefix list representing government IP ranges, then NAT the traffic out VPN 0.

Policies

Question

Refer to the exhibit. An engineer is modifying an existing data policy for DIA in VPN 23. Web browsing traffic toward government websites must be admitted for DIA. All other traffic must follow the regular routing path. Which policy sequence meets these requirements when appended to the existing configuration?

Options

  • Asequence 20 match source-data-prefix-list GOVERNMENT-WEBSITES ! action accept nat use-vpn 0
  • Bsequence 20 match destination-port 80 443 source-data-prefix-list GOVERNMENT-WEBSITES ! action accept nat use-vpn 0
  • Csequence 20 match source-port 80 443 destination-data-prefix-list GOVERNMENT-WEBSITES ! action accept nat use-vpn 0 nat fallback
  • Dsequence 20 match destination-port 80 443 destination-data-prefix-list GOVERNMENT-WEBSITES ! action accept nat use-vpn 0

How the community answered

(30 responses)
  • A
    7% (2)
  • B
    3% (1)
  • C
    13% (4)
  • D
    77% (23)

Why each option

To admit web browsing traffic to government websites for DIA, the policy must match destination ports 80 and 443 against a destination prefix list representing government IP ranges, then NAT the traffic out VPN 0.

Asequence 20 match source-data-prefix-list GOVERNMENT-WEBSITES ! action accept nat use-vpn 0

Using 'source-data-prefix-list GOVERNMENT-WEBSITES' incorrectly treats government website addresses as traffic sources rather than destinations, so outbound browsing traffic to government sites would not be matched.

Bsequence 20 match destination-port 80 443 source-data-prefix-list GOVERNMENT-WEBSITES ! action accept nat use-vpn 0

Using 'source-data-prefix-list GOVERNMENT-WEBSITES' has the same source-vs-destination error as option A; government websites are destinations of user traffic, not the source.

Csequence 20 match source-port 80 443 destination-data-prefix-list GOVERNMENT-WEBSITES ! action accept nat use-vpn 0 nat fallback

'source-port 80 443' matches traffic where the source port is 80 or 443, which applies to server responses rather than client web browsing requests, causing the policy to miss outbound user traffic.

Dsequence 20 match destination-port 80 443 destination-data-prefix-list GOVERNMENT-WEBSITES ! action accept nat use-vpn 0Correct

Matching 'destination-port 80 443' captures HTTP and HTTPS web browsing traffic, and 'destination-data-prefix-list GOVERNMENT-WEBSITES' correctly identifies government site IP addresses as the traffic destination; the 'action accept nat use-vpn 0' then steers matched flows directly to the internet via VPN 0 for DIA.

Concept tested: SD-WAN DIA data policy with destination prefix and port matching

Source: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/policies/ios-xe-17/policies-book-xe/data-policy.html

Topics

#SD-WAN Data Policy#Direct Internet Access (DIA)#Policy Match Conditions#Data Prefix List

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-415 Practice