Cisco SD-WAN Data Policy Sequence Precedence for DIA
Short answer
A Insert the new data policy sequence before the existing catch-all rule (Seq 20) to ensure government website traffic matches the Direct Internet Access and TLOC source address settings first.
Question
• When browsing government websites, the traffic must use direct internet access.
• The source address of the traffic leaving the site toward the government websites must be set to an IP range associated with the country itself, a particular TLOC.
The policy configuration is as follows:
Key Takeaways
Tests understanding of SD-WAN data policy evaluation order; the trap is placing new rules after a catch-all sequence where they will never be reached.
Learn how to configure Cisco SD-WAN data policies by understanding sequence numbering. Answer A shows why new rules must precede catch-all entries to apply Direct Internet Access correctly.
Common mistake: Choosing an option that places the new rule after Sequence 20. This is wrong because SD-WAN processes data policies in ascending sequence order, so a later rule will never match if an earlier rule catches all traffic.
Expert Analysis
Direct Internet Access (DIA) Placement
The requirement specifies that traffic browsing government websites must use Direct Internet Access (DIA). In Cisco SD-WAN data policies, DIA is typically configured as a match condition or an action. The key constraint is the sequence numbering. Data policies are processed sequentially from lowest to highest sequence number.
Sequence Logic and Trap Avoidance
The existing configuration likely has a catch-all rule at Sequence 20 that handles general internet traffic or default routing. If the new rule for government websites is placed after Sequence 20 (e.g., Sequence 30), it will never be evaluated because the traffic will already match the earlier catch-all rule. Therefore, the new policy entry must be inserted before the existing catch-all rule.
Analyzing the Options
- Option A: Places the new rule at Sequence 10, which is before the catch-all at Sequence 20. This ensures the specific traffic is matched first.
- Option B: Likely places it after Sequence 20, making it ineffective due to the sequential processing order.
- Option C: Might have incorrect syntax or placement relative to the TLOC source address modification.
- Option D: Similar to B, likely fails the sequence precedence test.
The comment "Q is about sequence numbering - must come before the catch-all seq 20" confirms this logic. The correct configuration must insert the new match-action pair at a lower sequence number than the existing default/catch-all rule to ensure it takes precedence.
Conclusion
The engineer must modify the data policy by adding a new sequence entry with a number lower than the existing catch-all (Seq 20). Option A correctly demonstrates inserting the new rule at Seq 10, ensuring government website traffic is matched against the DIA and TLOC source NAT rules before hitting the generic catch-all.
Exam Strategy
When configuring SD-WAN policies, always check the sequence numbers carefully. New specific rules must have lower sequence numbers than general or catch-all rules to ensure they are evaluated first. If you see a 'catch-all' or default rule, any new specific requirement must be inserted above it numerically.
Frequently Asked Questions
Why does the sequence number matter in SD-WAN data policies?
What happens if I place a new rule after a catch-all rule?
Community Votes
67% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 6 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 6
-
Gycu 👍 3 Answered CC correct answer
-
mikidvd51 👍 1What about this? Where is this in configurarion? • The source address of the traffic leaving the site toward the government websites must be set to an IP range associated with the country itself, a particular TLOC.
-
Zizo_Yassin 👍 1 Answered AI think answer is A. It's the only one that includes DIA as required in the question.
-
uzbin 👍 1Q is about sequence numbering - must come before the catch-all seq 20.
-
westh4m1234 👍 1 Answered CIf you look at the standard config seq 10 > seq 20 it has DIA already
Show 1 more comment
-
uzbin 👍 1Extra (unneccesary) info just to confuse everyone?
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All 300-415 Questions
Access 120 questions with complete answers and detailed explanations.
View Full 300-415 Practice Test →