300-415 — frequently asked questions

Yes, you can create and edit templates in the vManage GUI/database. The limitation is only that these templates cannot be pushed (propagated) to the WAN Edge devices.

No, IPsec tunnels are established and maintained directly between WAN Edge devices. They do not depend on vManage connectivity to stay up.

Local termination allows the SD-WAN device to handle retransmissions over the WAN link, preventing end-host timeouts due to high latency or packet loss.

SACK allows the receiver to acknowledge non-contiguous blocks of received data, enabling faster and more efficient retransmission of only lost packets.

Feature parcels are the configuration blocks inside a feature profile; the Feature Profile itself is created and organized under a Configuration Group in UX 2.0.

No. Feature templates belong to the older UX 1.0 workflow; UX 2.0 uses Configuration Groups containing Feature Profiles built from Feature Parcels.

Application-aware routing matches on application signatures, not on prefixes. The policy is scoped to a VPN and site list, so a prefix list is unnecessary.

No separate color list is mandatory, but the TLOC colors (e.g., MPLS, public internet) must be configured on the interfaces before you can select a preferred color.

In the Enterprise CA model, the vManage controller manages the certificate lifecycle. The edge trusts the vManage, so the vManage generates the CSR and installs the final cert to authenticate the edge.

Manual CA requires the edge to handle all CSR and installation steps. Enterprise CA integrates with a corporate PKI where vManage facilitates the signing process, simplifying edge management.

Cisco's vSmart ESXi deployment uses one NIC for management and control connectivity and a second for data/overlay traffic, so a single vNIC is not enough.

No; vSmart uses two vNICs, while vManage and other SD-WAN components have their own separate VM resource and NIC requirements.

Six is the default multiplier that averages the last six poll intervals for AAR SLA classification; seven is the separate default multiplier used for tunnel liveness detection.

It multiplies the poll interval to define how far back AAR looks when calculating mean loss, mean latency and mean jitter for the tunnel.

vManage can be configured manually without direct Internet access; the vBond controller itself reaches the PnP Connect service to obtain its configuration.

Yes, the controller profile can use an IP address to identify vBond; DNS is not a strict requirement for the PnP Connect deployment process.

Queue mapping ties a forwarding class to a platform-specific hardware queue, so it is a per-device Local Policy list; Centralized Policy is for fabric-wide intent like topology and app-route.

The WAN interface (VPN0) is the transport egress where congestion and scheduling occur, so SD-WAN QoS maps are attached there; service-side QoS is LAN-facing and does not protect WAN transport.

A localized data policy only does per-interface QoS (classification, marking, shaping, queuing). It cannot probe tunnels or move the voice flow to a link with lower delay.

A centralized data policy binds voice traffic to an SLA class; vSmart programs BFD-based probing and the routers forward voice over the tunnel whose delay, jitter and loss meet that class.

Quick Connect only configures WAN transport settings in VPN 0, so service-side VPN templates must be added separately to complete the SD-WAN overlay and carry service traffic.

No, Quick Connect focuses on WAN transport VPN 0; management and service VPNs are outside its scope, and only service VPNs are required to finish the overlay bring-up.

No. The vBond orchestrator is shared across all tenants, so four tenants still use one shared vBond (A).

Cisco SD-WAN does not require three vBond controllers in multitenancy; the orchestrator count is not tied to tenant count, and a single shared vBond serves all tenants.

It forces the router to use the older RFC 1583 metric calculation for inter-area paths, which differs from the newer RFC 2328 method.

Originate controls whether the router generates summary LSAs, while RFC 1583 Compatible controls how the cost of those routes is computed.

No, each region typically has its own set of vSmart controllers. They establish IPsec tunnels with each other for control plane communication.

Yes, SLA-based routing is available within each region. However, the defining feature for inter-region traffic is the encrypted tunnel provided by Multi-Region Fabric.

Yes, it significantly increases bandwidth consumption because duplicate traffic is transmitted on all selected paths.

Enable it only for critical applications where packet loss causes unacceptable jitter or latency, due to the high bandwidth cost.

While AMP integrates with SD-WAN, the 'Threat Grid' component mentioned is a cloud-based sandbox, not a local feature running on the vEdge router.

No, Snort IPS is not a built-in feature of the Cisco Catalyst SD-WAN software; you would typically use the Enterprise Firewall or integrate with a separate IPS appliance.

SLA acts as a filter. If both meet SLA and no preferred color is set, the path with the best underlying metrics (latency/loss) is chosen.

Without explicit ECMP configuration, SD-WAN selects a single best active path based on policy and metrics, not load balancing.

Inline tagging embeds the SGT in the data frame (Layer 2), while SXP maps IP addresses to SGTs over TCP (Layer 3) for devices that cannot modify frames.

No, offline tagging implies manual or delayed assignment. Real-time propagation requires either inline tagging or SXP to ensure immediate policy enforcement.

vManage is the management plane for provisioning and configuration via a GUI/API. vSmart is the control plane that distributes routing policies and maintains control sessions between WAN Edge routers.

No, vBond is strictly an orchestrator. It authenticates devices, discovers controllers, and facilitates NAT traversal, but it does not push configurations or manage the network state.

It provides live statistics on data traffic characteristics for operational tunnels, reflecting current routing performance.

It typically offers historical or aggregated data rather than the immediate real-time status needed for active monitoring.

Although a load balancer can optionally front vBond orchestrators, the universal requirement is an FQDN that resolves to the vBond IPs; the load balancer still uses a virtual FQDN.

No, STUN is used for NAT traversal to help vEdge devices discover their public IP, not for vBond redundancy.

Malware protection is handled by separate Cisco SD-WAN security features, while the IPS signature sets selectable in vManage security policy are only Connectivity, Balanced, and Security.

Yes. Balanced is one of the three predefined IPS signature sets in vManage, along with Connectivity for higher throughput and Security for stricter inspection.

STUN on vBond does not keep Edge routers behind a NAT firewall while controller addresses stay unNAT-ed; it reports back each device's translated IP and port so correct TLOCs and tunnels can be built.

No. STUN address discovery applies to any transport where NAT translation occurs, such as broadband or LTE internet links, not just MPLS TLOCs as option C claims.

The only Microsoft factory list in vManage is named Microsoft_Apps. Microsoft_Office365 is not shipped by default and must be created or selected from DPI-recognized SaaS applications.

No. Both preconfigured lists are read-only: you can view their entries and reference them in policies, but you cannot edit or delete them.

The IPsec SA must outlive the entire OMP restart window so tunnels are not torn down while OMP is recovering; doubling the restart interval guarantees the SA stays valid.

No. 36 hours is only 1.5× the restart interval, and the rekey timer must be at least 2× that value, so 48 hours is the minimum valid setting.

It provides per-interface QoS, marking, and ACL actions on one edge; it does not evaluate tunnel delay or select a path across the WAN.

In a centralized data policy on the controller, where voice traffic matches an SLA class whose delay threshold is below 50 ms.

Cisco documents that ip-prefix 0.0.0.0/0 le 16 matches all IP prefixes with lengths from /1 through /16. The /0 base carries no network information to match, so effective matches begin at /1.

Anchoring on 0.0.0.0/1 binds the match to a single /1 address block instead of providing the general /1–/16 prefix-length range that 0.0.0.0/0 le 16 delivers.

Administrative distance is evaluated before route preference in the OMP path-selection sequence on vEdge, so it settles the tie first; route preference only applies once AD values are equal.

Router ID comparison only separates routes advertised by different devices. Both routes here are learned from the same vEdge at S4406T9E02F15, so they share one router ID.

That default only pushes service-side OSPF routes into OMP. Advertising WAN Edge overlay routes out to the LAN is a separate redistribution step, and Cisco references BGP for it.

No. OSPF, EIGRP or static routes also carry traffic, but the exam wants the single best answer, and BGP is the protocol tied to service-side WAN Edge route advertisement.

A controller group upgrade does not mean every software operation must include vManage, vBond, and vSmart; the question asks about image management, where vManage's repository is central.

vManage cannot activate a lower major release after an upgrade, but that caveat is narrower than option B and does not describe the normal HTTP/FTP upload and distribution workflow.

vBond only authenticates a newly joining WAN Edge during onboarding and points it to vManage and vSmart. It never forms lasting OMP sessions or carries route and policy information.

vManage is the management and orchestration GUI/REST layer for templates, monitoring, and reporting. vSmart is the control-plane node that peers with Edges via OMP and distributes routes and policies.

Classification assigns the Security Group Tag, propagation shares that tag across the network, and enforcement applies the tag-based policy at the device handling the traffic.

The item states not all options are used, so distractors such as authentication or SGT allocation are sub-steps of classification rather than separate phases and should stay in the source column.

The ISR1K's local zone-based/Application-Aware firewall runs within 4 GB of DRAM, so it is not blocked by the memory limit. Only URL filtering and Cisco AMP carry an 8 GB DRAM minimum, which is what the selection constrains.

Yes for those services: Cisco AMP requires 8 GB DRAM and 8 GB flash, and URL filtering needs 8 GB DRAM/flash for cloud lookups (16 GB for on-box database lookups). A 4 GB ISR1K cannot host them.

Delay and jitter are raw inputs collected during probing; Cloud OnRamp combines them with loss into a single 0-10 QoE score, and that score is what rates the path.

The score lets Cloud OnRamp compare all permissible paths to the SaaS app and select the highest-scoring path, and it can trigger path changes when scores degrade.

It limits how many paths are advertised per prefix, usually equal-cost paths, but it does not enable advertisement of backup/non-best OMP paths.

No. It advertises backup paths in addition to the best route; best-path selection remains an OMP decision process.

IaaS OnRamp automates WAN Edge deployment into AWS, Azure or GCP for a customer that already runs Catalyst SD-WAN; it assumes a fabric the partner does not own.

It hosts shared SD-WAN controllers and WAN Edge instances in a colocation facility, so partners attach to the fabric there instead of installing routing appliances at their own sites.

Nat overload (PAT) is preferred for DIA because it allows many internal IPs to share a single public IP, saving address space compared to a fixed pool.

It ensures that if the direct internet link fails, the traffic falls back through the IPsec tunnel (VPN) to maintain connectivity to the destination.

VLAN 512 is the default Management VLAN used for control plane communication with controllers, not for user data plane traffic like Admin VLAN.

Yes, in Cisco SD-WAN, a higher TLOC preference value indicates a more preferred path compared to a lower value.