300-415 Cisco Implementing Cisco SD-WAN Solutions (300-415 ENSDWI) Free Practice Exam Questions (2026 Updated)

https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/policies/vedge-20-x/policies-book/service-chaining.html

https://sdwan-docs.cisco.com/Product_Documentation/vManage_Help/Release_17.2/Configuration/Templates/OMP

To establish a strict hub-and-spoke topology in Cisco SD-WAN for a specific VPN, such as VPN2, a control policy must be configured. This control policy dictates how traffic flows between sites, ensuring that all branch traffic is routed through the hub site.

Control Policy Components:

Site Lists: Define which sites are considered hubs and which are branches.

VPN Lists: Identify the VPNs to which the policy applies.

Control Policy: Use sequences to match routes and specify actions to accept or reject traffic based on the defined topology.

Policy Analysis:

Option A: Correctly defines site lists for hub sites (site-id 1-2) and creates a control policy that matches routes for VPN2, accepting routes from hub sites and rejecting routes from others. This ensures that traffic from branches (other sites) is only accepted if it routes through the hubs.

Other options either incorrectly define the site lists or do not properly match and set the routes to enforce the strict hub-and-spoke topology.

Policy Configuration:

policy

lists

vpn-list VPN2

vpn 2

site-list hub_sites

site-id 1-2

!

control-policy vpn_multi_topology

sequence 10

match route

site-list hub_sites

vpn-list VPN2

!

action accept

!

sequence 20

match route

vpn-list VPN2

!

action reject

!

default-action accept

Cisco SD-WAN Control Policy Configuration Guide

Cisco SD-WAN Hub-and-Spoke Topology Deployment Guide

Solution:

Use cu-red under interfaces facing SW1 & SW3:

On R1:

interface Ethernet0/0

ip vrf forwarding cu-red

ip address 192.168.1.254 255.255.255.0

Check reachability to SW1:

R1#ping vrf cu-red 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

On R2:

interface Ethernet0/0

ip vrf forwarding cu-red

ip address 192.168.2.254 255.255.255.0

Check reachability to SW3:

R2#ping vrf cu-red 192.168.2.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!!!!!

Use vrf cu-green for SW2 & SW4:

On R1:

interface Ethernet0/1

ip vrf forwarding cu-green

ip address 192.168.20.254 255.255.255.0

Test reachability to SW2:

R1#ping vrf cu-green 192.168.20.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.22.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

On R2:

interface Ethernet0/1

ip vrf forwarding cu-green

ip address 192.168.22.254 255.255.255.0

Test reachability to SW4:

R2#ping vrf cu-green 192.168.22.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

On R1:

interface Ethernet0/2.100

mpls ip

!

interface Ethernet0/2.200

mpls ip

!

Configure BGP:

router bgp 65000

neighbor 10.10.10.2 remote-as 65000

neighbor 10.10.20.2 remote-as 65000

!

address-family vpnv4

neighbor 10.10.10.2 activate

neighbor 10.10.20.2 activate

exit-address-family

!

address-family ipv4 vrf cu-green

redistribute connected

exit-address-family

!

address-family ipv4 vrf cu-red

redistribute connected

exit-address-family

!

R1(config)#ip vrf cu-red

R1(config-vrf)#route-target both 65000:100

!

R1(config)#ip vrf cu-green

R1(config-vrf)#route-target both 65000:200

On R2:

interface Ethernet0/2.100

mpls ip

!

interface Ethernet0/2.200

mpls ip

!

router bgp 65000

neighbor 10.10.10.1 remote-as 65000

neighbor 10.10.20.1 remote-as 65000

!

address-family vpnv4

neighbor 10.10.10.1 activate

neighbor 10.10.20.1 activate

exit-address-family

!

address-family ipv4 vrf cu-green

redistribute connected

exit-address-family

!

address-family ipv4 vrf cu-red

redistribute connected

exit-address-family

R2(config)#ip vrf cu-red

R2(config-vrf)#route-target both 65000:100

!

R2(config)#ip vrf cu-green

R2(config-vrf)#route-target both 65000:200

Verification:

From SW1 to SW3:

SW1#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

But can’t Reach SW2 or SW4 in VRF cu-green:

SW1#ping 192.168.22.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.22.1, timeout is 2 seconds:

U.U.U

Success rate is 0 percent (0/5)

SW1#ping 192.168.20.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:

U.U.U

Success rate is 0 percent (0/5)

Same Test for SW2:

From SW2 to SW4:

SW2#ping 192.168.20.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

But can’t Reach SW3 or SW1 in VRF cu-red:

SW2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

U.U.U

Success rate is 0 percent (0/5)

SW2#ping 192.168.2.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:

U.U.U

Success rate is 0 percent (0/5)

Both R1 & R2 has separate tables for VRFs cu-red and cu-green.

When dealing with overlapping IP addresses in different branch sites, it's crucial to use NAT (Network Address Translation) to avoid IP conflicts and establish proper communication.

NAT Configuration:

Source NAT: This involves translating the source IP addresses of the packets as they leave a specific interface. This can help avoid IP conflicts by ensuring that the IP addresses used within the network are unique.

Data Policy: A data policy must be created that matches the source IP addresses and applies the NAT pool to translate these addresses.

Option A Analysis:

Policy Definition: The data policy Srvc_Plane_NAT includes a sequence that matches the source IP 10.0.0.1/32 and accepts the action to apply NAT using nat pool 1.

Interface Configuration: The interface ge0/0/0 is configured with the IP address 192.168.1.1/32 and is not shut down, ensuring it is active and can handle the NAT translation.

Cisco SD-WAN NAT Configuration Guide

Cisco SD-WAN Data Policy Configuration Documentation

https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/Cisco_Cloud_onRamp_for_IaaS_AWS_Version2.html