SDWAN - Attributes and Policy Criteria

A remote site needs a connection to send confidential company information to headquarters with a minimum data rate of 50 Mbps at all times. It should be limited to 200 Mbps at maximum.

 

Which policy is appropriate?

• <polA [<ENCRYPTION, Required-Always>
   <INTERNET-BREAKOUT, Disabled>
   <PUBLIC-PRIVATE, Private-Only>
   <BILLING-METHOD, Flat-rate-Only>
   <BACKUP, Enabled> <BANDWIDTH, 50Mbps, none>]>

• <polA [<ENCRYPTION, Required-Always>
   <INTERNET-BREAKOUT, Disabled>
   <PUBLIC-PRIVATE, Private-Only>
   <BILLING-METHOD, Flat-rate-Only>
   <BACKUP, Enabled> <BANDWIDTH, 50Mbps, 200Mbps>]>

• <polA [<ENCRYPTION, Required-Always>
   <INTERNET-BREAKOUT, Disabled>
   <PUBLIC-PRIVATE, Private-Only>
   <BILLING-METHOD, Flat-rate-Only>
   <BACKUP, Enabled> <BANDWIDTH, 150Mbps, 50Mbps>]>

• <polA [<ENCRYPTION, Required-Always >
   <INTERNET-BREAKOUT, Disabled>
   <PUBLIC-PRIVATE, Private-Only>
   <BILLING-METHOD, Flat-rate-Only>
   <BACKUP, Enabled> <BANDWIDTH, none, 50Mbps>]>

An SD-WAN is deployed to a marketing firm to connect their four branches and its headquarters.  At the request of the firm, the Service Provider designed it to limit Internet traffic at each branch.  During the rollout, employees discover they are unable to access the Internet.  Investigating the issue, the Service Provider discovers:

• Inter-branch communications works correctly.

• The INTERNET-BREAKOUT Policy is set to Enabled

• The local Internet UCS is working at each branch.

What should the Service Provider verify next?

• ENCRYPTION Policy criteria

• BANDWIDTH Policy criteria

• PUBLIC-PRIVATE Policy criteria 

• BACKUP Policy criteria 

A legacy branch office is being integrated into an SD-WAN network.  The office currently has a primary and backup MPLS UCS via two ports on a single router.  The office needs Local Internet Breakout and site-to-site access.  What needs to be done to accomplish this?

• Add a Private UCS. 

• Set INTERNET-BREAKOUT to Enabled for all flows over the current UCS.

• Add a second router. 

• Add a Public UCS.

A school district is connecting Student and Faculty traffic across an SD-WAN Service.
Each SWVC End Point explicitly maps policies to the Application Flow\Zone matchup as shown above.
Use the following Zones and Zone-wide policies below:

Zone Faculty

·      IP range = [172.16.0.0/12, 192.168.0.0/23]

·      Policies = [Web ¬  policy2, Voice ¬  policy3]

Zone Student

·      IP range = [10.2.0.0/16]

·      Policies = [Web ¬  policy3]

A packet arrives at UNI 3 with the following attributes:

·      Application Flow of Office-365

·      Source IP = 172.16.30.99

What is the result?

• The Zone is Faculty and the policy applied is policy2.

• The Zone is Student and the policy applied is policy2.

• The Zone is Faculty and the policy applied is policy1.

• The packet is discarded.

A school district has a primary and backup set of data centers for three school locations;
all connected using an SD-WAN Service Provider Network as shown above.
Student traffic between schools needs to be allowed. However, Faculty data should only be shared with the primary/backup data center locations.

What is the correct virtual topology that should be deployed by the SD-WAN Service Provider for the school district?

• • (Student, multipoint-to-multipoint ([X,Y]))

  • (Faculty, Rooted-multipoint, ([A,B,C])

• • (Student, multipoint-to-multipoint ([A,B,C]))

  • (Faculty, Rooted-multipoint, ([A,B,C],[X,Y]))

• • (Student, multipoint-to-multipoint ([A,B,C]))

  • (Faculty, Rooted-multipoint, ([X,Y],[A,B,C])

• • (Student, multipoint-to-multipoint ([A,B,C]))

  • (Faculty, Rooted-multipoint, ([X,Y],[A,B,C],[ ])

After implementing SD-WAN services, the SD-WAN customer has a security audit performed. The results of the security audit indicate security vulnerabilities in all of the applications that require a secure connection.

• BILLING-METHOD Policy 

• OVERLAY Policy

• ENCRYPTION Policy 

• UNDERLAY Policy 

An HTTP packet that originated at 10.1.1.2 is sent to a web server at destination 10.2.2.17.  Three Application Flows are defined as follows:

A  SDAV4 = 10.2.2.0/24,   DPORT= 80

B  SAV4 = 10.1.1.0/24,     SPORT = 80

C  DAV4 = 10.1.1.0/24,    SDPORT = 80

Which of the follow Application Flows will it be associated with?

• Application Flow C 

• None; the traffic is discarded.

• Application Flow A 

• Application Flow B 

A school has applied Block Lists for the category of gambling websites to prevent student and faculty access. Unfortunately, one website is incorrectly being blocked as a gambling website when students should be allowed access. How should the school go about modifying the Block List as a Subscriber?

• The school can update the Block List which will over-write the Provider’s database to push to other Subscribers.

• As a Subscriber, the school can make a request to the Provider web-portal page. The Service Provider will give a time frame as to when the update will happen.

• Subscribers cannot make changes nor request changes be made to the Block List; otherwise sync issues can arise.

• The school can put in a request, but it is not the Service Providers responsibility to give a time frame as to when the request will be fulfilled