300-440 Designing and Implementing Cloud Connectivity (ENCC) Questions and Answers

 BFD (Bidirectional Forwarding Detection) is a protocol that detects failures in the overlay tunnel between Cisco SD-WAN devices. BFD packets are sent and received periodically by each device to check the liveliness and quality of the connection. If a device does not receive a BFD packet from its peer within a specified timeout interval, itconsiders the peer to be unreachable and reports a BFD down event. This event triggers a control connection state change and a possible route change in the SD-WAN fabric.

In this scenario, the engineer discovers that BFD is flapping on vEdge1, which means that the BFD session between vEdge1 and the remote Edge device is going up and down repeatedly. This indicates a connectivity issue between the two devices, such as network congestion, packet loss, or misconfiguration. The most likely cause of the problem is that the remote Edge device failed to respond BFD keepalives within the timeout interval, which resulted in a BFD timeout event on vEdge1. This event caused vEdge1 to mark the remote Edge device as down and notify the control plane. The control plane then tried to establish a new BFD session with the remote Edge device, which may have succeeded or failed depending on the network condition. This cycle of BFD session creation and deletion caused the BFD flapping on vEdge1.

The other options are less likely to be the cause of the problem. Option A is incorrect because if the remote Edge device BFD was down, vEdge1 would not receive any BFD packets from it and would not flap. Option C is incorrect because if the remote Edge device had a duplicate IP address, vEdge1 would not be able to establish a BFD session with it in the first place. Option D is incorrect because the control plane does not delete the BFD session unless there is a configuration change or a port-hop event on the device. References: Bidirectional Forwarding Detection Flap-Reason Definitions on Cisco vEdge Routers, Cisco Catalyst SD-WAN BFD, Cisco SD WAN: BFD (Bidirectional Forwarding Detection)

To send traffic into an IPsec tunnel to the cloud VPN gateway, the engineer must configure two actions:

• Configure access lists that match the interesting user traffic. This is the traffic that needs to be encrypted and sent over the IPsec tunnel. The access lists are applied to the crypto map that defines the IPsec parameters for the tunnel.
• Configure policy-based routing (PBR). This is a technique that allows the engineer to override the routing table and forward packets based on a defined policy. PBR can be used to send specific traffic to the IPsec tunnel interface, regardless of the destination IP address. This is useful when the cloud VPN gateway has a dynamic IP address or when multiple cloud VPN gateways are available for load balancing or redundancy. References:
• Designing and Implementing Cloud Connectivity (ENCC) v1.0, Module 3: Implementing Cloud Connectivity, Lesson 3: Implementing IPsec VPNs to the Cloud, Topic: Configuring IPsec VPNs on Cisco IOS XE Routers
• Security for VPNs with IPsec Configuration Guide, Cisco IOS XE, Chapter: Configuring IPsec VPNs, Topic: Configuring Crypto Maps
• [Cisco IOS XE Gibraltar 16.12.x Feature Guide], Chapter: Policy-Based Routing, Topic: Policy-Based Routing Overview

Enhanced Policy-Based Routing (ePBR) is used to direct packets that arrive at an interface to a specified next-hop. It is very useful in managing a large number of configured access lists more efficiently. In ePBR, the router drops the traffic packets if the next hop configured in the PBR policy is not reachable. To avoid packet loss in such scenarios, you must configure multiple next hops for each access control entry.

Here are the steps to configure ePBR for IPv4 using Cisco vManage:

• Configure an extended ACL: This step involves defining the network or the host. For example, you can permit IPv4 traffic from any source to specific hosts.
• Configure a class map that matches the ACL: Class maps match the parameters in the ACLs. For instance, you can create a class map of type traffic and match it with the previously created ACL.
• Configure the policy map with the action to set the next hop: Policy maps with ePBR then take detailed actions based on the set statements configured. You can configure an ePBR policy map with the class map and set the next hop.
• Apply the service policy on the interface: Finally, you apply the ePBR policy map to the interface. For example, you can apply the policy map to a GigabitEthernet interface.

References :=

• Implementing Enhanced Policy Based Routing - Cisco
• Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE
• How to configure PBR - Cisco Community

Step 1 = Navigate to Configuration, select Templates, and then select Device Templates. Step 2 = Click Create Template, select From Feature Template, and then select the device model. Step 3 = Select Device, select Service Node, and then set Template Name and Description. Step 4 = Attach the device template to the device.

The process of configuring an AppGoE service node for WAN optimization for applications that are hosted in the cloud using Cisco vManage for C8000V or C8500L-8S4X devices involves several steps12.

• Navigate to Configuration, select Templates, and then select Device Templates: This is the first step where you navigate to the Templates section in the Configuration menu of Cisco vManage1.
• Click Create Template, select From Feature Template, and then select the device model: In this step, you create a new template for the device model from the feature template1.
• Select Device, select Service Node, and then set Template Name and Description: After setting up the template, you select the device and the service node, and then set the template name and description1.
• Attach the device template to the device: Finally, you attach the created device template to the device1.

References :=

• AppQoE - Step-by-Step Configuration - Cisco Community
• Cisco Catalyst SD-WAN AppQoE Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x

Step 1 = crypto map cisco 1 ipsec-isakmp Step 2 = set peer 192.168.10.1 default Step 3 = set peer 192.168.20.1 Step 4 = set security-association idle-time 120 default

The process of editing the settings of a site-to-site IPsec VPN connection between an on-premises Cisco IOS XE router and Amazon Web Services (AWS), and configuring IPsec to support multiple peers and failover after 120 seconds of idle time on the first entry of the crypto map named Cisco involves several steps123456.

• crypto map cisco 1 ipsec-isakmp: This command is used to create a new entry in the crypto map named “cisco”. The “1” is the sequence number of the entry, and “ipsec-isakmp” specifies that the IPSec security associations (SAs) should be established using the Internet Key Exchange (IKE) protocol13.
• set peer 192.168.10.1 default: This command is used to specify the IP address of the default peer for the crypto map entry. In this case, the default peer is at IP address 192.168.10.115.
• set peer 192.168.20.1: This command is used to add an additional peer to the crypto map entry. In this case, the additional peer is at IP address 192.168.20.1. This allows the IPsec VPN to support multiple peers56.
• set security-association idle-time 120 default: This command is used to set the idle time for the security association. If no traffic is detected over the VPN for the specified idle time (in this case, 120 seconds), the security association is deleted, and the VPN connection fails over to the next peer46.

References :=

• Configure a Site-to-Site IPSec IKEv1 Tunnel Between an ASA and a Cisco IOS Router - Cisco
• Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services - Cisco Community
• Configuring Site to Site IPSec VPN Tunnel Between Cisco Routers
• Configure Failover for IPSec Site-to-Site Tunnels with Backup ISP Links on FTD Managed by FMC - Cisco
• Does Setting Multiple Peers in a Crypto Map Also Support Parallel IPSec Connections - Cisco Community
• Multiple WAN Connections — IPsec in Multi-WAN Environments | pfSense Documentation
• Multiple Set Peer for VPN Failover - Server Fault

 Security groups are a feature in AWS that allow you to control the inbound and outbound traffic to your instances. They act as a virtual firewall that can filter the traffic based on the source, destination, protocol, and port. You can assign one or more security groups to your instances, and each security group can have multiple rules. Security groups are stateful, meaning that they automatically allow the response traffic for any allowed inbound traffic, and vice versa. Security groups are essential for securing your nodes in the AWS EKS cluster, as they can prevent unauthorized access to your Mongo Atlas database or other resources. You can also use security groups to isolate your nodes from other instances in the same VPC or subnet, or to allow communication between nodes in different clusters or regions. References :=

• AWS Security Groups
• Security Groups for Your VPC
• Security Groups for Your Amazon EC2 Instances
• Security Groups for Your Amazon EKS Cluster

• Display the time and process information of the device, as well as CPU, memory, and disk usage data. = show sdwan system status1
• Validate the configured zone-based firewall. = show policy-firewall config1
• Display information about application-aware routing policy matched packet counts on the Cisco IOS XE SD-WAN devices. = show sdwan policy app-route-policy-filter1
• View the security information that is configured for IPsec tunnel connections. = show sdwan security-info

The commands used to identify issues on a Cisco IOS XE SD-WAN device are as follows1:

• show sdwan system status: This command is used to display the time and process information of the device, as well as CPU, memory, and disk usage data1.
• show policy-firewall config: This command is used to validate the configured zone-based firewall1.
• show sdwan policy app-route-policy-filter: This command is used to display information about application-aware routing policy matched packet counts on the Cisco IOS XE SD-WAN devices1.
• show sdwan security-info: This command is used to view the security information that is configured for IPsec tunnel connections1.

References :=

• Cisco IOS XE Catalyst SD-WAN Qualified Command Reference
• Cisco Catalyst SD-WAN Command Reference
• Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, Cisco IOS XE
• SD-WAN Tunnel Interface Commands - Cisco

The process of configuring an SLA class to specify the maximum packet loss, packet latency, and jitter allowed on a connection using Cisco vManage involves several steps12.

• Click Configuration, select Policies, and then select Add Policy: This is the first step where you navigate to the Policies section in the Configuration menu of Cisco vManage1.
• Click SLA Class and then click New SLA Class List: In this step, you create a new SLA Class List1.
• Select Criteria, select Loss, Latency and Jitter, and then click Add: After setting up the SLA Class List, you select the criteria for the SLA class. In this case, the criteria are Loss, Latency, and Jitter1.
• Set values for Loss, Latency, Jitter, and App Probe Class: Finally, you set the values for Loss, Latency, Jitter, and App Probe Class1.

References :=

• Information About Application-Aware Routing - Cisco
• Policies Configuration Guide for vEdge Routers, Cisco SD-WAN Release 20