Drag and Drop Question Drag and drop the steps WAN Edge performs when on-boarded into the Cisco SD-WAN overlay from the left into the order they are completed on the right. Answer:

Question

Exhibit

Answer Area

Explanation

The question requires ordering the steps a WAN Edge device takes when onboarding into a Cisco SD-WAN overlay, starting with vBond authentication and ending with data plane tunnel establishment.

Approach. The correct interaction is to drag the steps from the left column into the right-hand 'Step' slots in the following order:

1. Step 1: WAN Edge authenticates to vBond.

   • Reasoning: The vBond orchestrator acts as the first point of contact for a new WAN Edge device joining the SD-WAN fabric. It authenticates the WAN Edge, provides it with the IP addresses of the vManage (management plane) and vSmart (control plane) controllers, and helps facilitate the initial secure connections.

2. Step 2: WAN Edge establishes a secure connection to vManage and vSmart.

   • Reasoning: After authenticating with vBond, the WAN Edge learns the details of vManage and vSmart. It then proceeds to establish secure DTLS/TLS control plane tunnels to these controllers. This allows vManage to manage the device and vSmart to distribute policies and routing information.

3. Step 3: WAN Edge establishes an OMP session to vSmart.

   • Reasoning: With the secure control plane tunnel to vSmart established, the WAN Edge initiates an Overlay Management Protocol (OMP) session with vSmart. OMP is the routing protocol of the SD-WAN overlay, through which vSmart exchanges routing, policy, and TLOC (Transport Locator) reachability information with the WAN Edge. This session is crucial for the control plane to function properly.

4. Step 4: WAN Edge establishes IPsec connections to other TLOC locations.

   • Reasoning: Once the control plane is fully established and the OMP session is active, vSmart distributes the TLOC information of other WAN Edge devices in the overlay. The local WAN Edge then uses this information to establish direct IPsec data plane tunnels with other WAN Edge devices (or TLOC locations). These IPsec tunnels are used to forward user data traffic securely across the SD-WAN fabric.

Common mistakes.

• common_mistake. A common mistake is to misorder the control plane establishment steps or place data plane establishment prematurely. For example:
• Placing 'WAN Edge establishes an OMP session to vSmart' before 'WAN Edge establishes a secure connection to vManage and vSmart' is incorrect because the OMP session relies on the underlying secure control plane tunnel to vSmart being already established.
• Placing 'WAN Edge establishes IPsec connections to other TLOC locations' before the OMP session is established is incorrect because the WAN Edge needs the TLOC information learned via OMP from vSmart to know where and how to build the IPsec data plane tunnels to other sites.
• Confusing the role of vBond as the initial orchestrator with vManage/vSmart for ongoing control plane and management can lead to misordering the initial authentication step.

Concept tested. Cisco SD-WAN architecture, WAN Edge onboarding process, roles of vBond, vManage, vSmart, OMP (Overlay Management Protocol), TLOC (Transport Locator), and the sequence of control plane and data plane establishment (DTLS/TLS and IPsec tunnels).

No community discussion yet for this question.