SD-WAN MPLS TLOC with No Controller Reachability: BFD over Both Transports
Company E wants to deploy Cisco SD-WAN with controllers in AWS. The company's existing WAN is on private MPLS without Internet access to controllers in AWS. An Internet circuit is added to a site in addition to the existing MPLS circuit. Which interface template establishes BFD neighbors over both transports?
Community Insight
The question tests how transport-level tunnel-interface parameters (max-control-connections, restrict, border/vbond-alley) affect BFD neighbor formation versus controller (OMP/DTLS) reachability; the trap is assuming a transport that cannot reach the controllers cannot carry BFD at all.
When a Cisco SD-WAN site has a private MPLS transport that cannot reach controllers hosted in AWS plus a newly added Internet circuit, the interface template must allow BFD on both TLOCs while preventing useless control connections on MPLS. The correct template sets max-control-connections 0 on the MPLS tunnel interface so BFD/data-plane neighbors still form, while control sessions ride the Internet transport.
Most learners pick C (simply enabling both transports) or D (limiting control connections), but C would attempt DTLS/OMP control sessions over the unreachable MPLS link, and the wrong combination fails to keep BFD up on both transports. A is also wrong because restrict blocks tunnel formation between different colors (MPLS to Internet).
Community Discussion (31 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is the interface template that enables BFD over both transports by setting the MPLS transport's tunnel interface to max-control-connections 0 (or equivalent) while leaving the Internet transport able to build DTLS/OMP sessions to vManage/vSmart/vBond in AWS. BFD neighbors are data-plane entities formed between TLOCs of WAN Edge routers, so a TLOC that has no route to the controllers can still carry BFD and IPsec traffic; only control connections are suppressed on that transport. Because the MPLS link is private with no Internet path, the vBond/DTLS and OMP sessions must terminate via the added Internet circuit, which is exactly what the B template permits. Multiple community analysts confirm this design, noting that tunnels such as MPLS-to-MPLS and Internet-to-Internet (and MPLS-to-Internet where reachable) still establish, so both transports carry BFD.Why the Other Options Are Wrong
Option A applies restrict, which limits tunnels to the same color and therefore prevents formation of tunnels between different transports — it also risks blocking the very cross-transport paths and does not address the unreachable control plane on MPLS. Option C omits the max-control-connections 0 setting, so the router would try (and fail) to build control connections toward vBond/vSmart over the MPLS link, since the question states MPLS has no Internet access to the AWS controllers. Option D caps or constrains control connections in a way that yields only one usable control session in a manner inconsistent with reaching both vSmart controllers, and it does not correctly combine the Internet-side control plane with an MPLS transport that must remain BFD-capable. The key differentiator is that the MPLS TLOC must keep BFD enabled while being barred from control traffic — only B does that.Community Comment Notes
Commenters converged on B: bearsaxman explained that "Without configuring max-control-connections to 0, BFD sessions will not form on the MPLS link" for control purposes while data-plane tunnels still work, and densma stated simply "B is the only correct answer." Idro reinforced that "the router shouldn't establish control connections through the mpls link" while Roger95 and Arsenal16 both argued B, with the latter warning that enabling restrict "may limit the traffic to only specific paths or interfaces" and interfere with BFD across MPLS and Internet. A minority voice, Clouddon, argued for D, but the majority reasoning ties directly to the question's stated constraint that controllers in AWS are unreachable over MPLS.Official Reference
Exam Strategy
For image-based interface-template questions, diff the XML blocks on tunnel-interface knobs: max-control-connections, restrict, and border/vbond settings. When a transport cannot reach controllers, expect max-control-connections 0 on that TLOC so BFD still forms.
Frequently Asked Questions
Why can't BFD form on the MPLS link if it has no access to controllers in AWS?
BFD is a data-plane protocol between WAN Edge TLOCs; it does not require DTLS/OMP sessions. Only control connections need controller reachability, so they are disabled on MPLS with max-control-connections 0.
Why is enabling restrict on the MPLS template wrong for this scenario?
Restrict allows tunnels only between TLOCs of the same color, blocking MPLS-to-Internet tunnels and limiting the dual-transport data plane the site is designed to provide.
Related Analysis
Practice All 300-415 Questions
Access 120 questions with complete answers and detailed explanations.
View Full 300-415 Practice Test →
t reachable via MPLS (as explaint in the Text) -> so C cant be the right answere - onyl 1 Controll Session make no sense, because vSmarts are also Controllers and not reachable vie MPLS (as explaint in the Text) -> So D can`t be the right answere - Answere A limits the IPSEC Tunnels to the color MPLS (but for this, the Controllers DTLS Session must be formed to learn and advertise OMP Routes) - Answere B can only the right Answere, because with setting the max. Controll Sesisons to 0 we told the Edge Device it is not possible to form Control Sessions about this MPLS link and the Edge Device advertise about the existing Internet Control Sessions the MPLS Color TLOCs to the vSmart. This Help to build IPSEC Tunnel over Private Links without creating Control Tunnels over this Cloud!