An enterprise has deployed a VMware SD-WAN solution with Edges in many different located to different Partner Gateways. Which design makes it possible to have dynamic branch to branch VPN tunnels…

Question

Options

• ADedicated at least one Gateway as a Controller, and few initial data plane packets will travers the
• BAdd Controller role to each Partner Gateway.
• CConfigure each partner Gateway as a Controller.
• DDedicate at least one Gateway as a Controller, and no data plan packets will traverse the

• A
  8% (4)
• B
  6% (3)
• C
  16% (8)
• D
  70% (35)

Explanation

In VMware SD-WAN, designating at least one Gateway as a Controller enables dynamic branch-to-branch (spoke-to-spoke) VPN tunnels by handling the control plane signaling that lets Edges discover each other and negotiate direct tunnels - and critically, zero data plane packets ever traverse the Controller itself; once the tunnel is brokered, traffic flows directly between Edges.

Why the distractors are wrong:

• A is almost right but fatally wrong on one detail - it claims some initial data packets traverse the Controller, which is false; the Controller is purely control plane
• B and C are structurally wrong - they suggest every Partner Gateway needs the Controller role, but you only need at least one dedicated Controller, not all of them

Memory tip: Think "Controller = Control plane only." It's a matchmaker, not a data mover - it introduces two Edges to each other, then steps aside. If you see an answer option saying data packets (even a few) traverse the Controller, it's a trap.

No community discussion yet for this question.