Configure Direct Internet Access with NAT and Tallback
Short answer
C Configure an accept action with nat overload and nat tallback to allow VPN99 to break out locally to the internet with fallback capability.
Question
Refer to the exhibit.
An engineer must configure a policy on a SD-WAN Controller device. This policy will allow VPN99 at branch 1 for direct internet access when accessing Google Apps and using the routing table upon its unavailability. Which configuration must be applied to meet this requirement?
Key Takeaways
The key concept is enabling local breakout for a specific VPN while ensuring fallback to the WAN when the primary path fails, using 'nat overload' instead of static or pool-based NAT.
This question tests the configuration of direct internet access (DIA) on Cisco SD-WAN controllers using data policies, specifically focusing on NAT overload and tallback behavior for VPN99.
Common mistake: Learners often confuse 'nat use-vpn 0' with 'nat overload', not realizing that DIA requires dynamic port address translation (overload) for multiple internal hosts accessing the internet.
Expert Analysis
Why the Answer Is Correct
The requirement is to allow VPN99 at branch 1 to access Google Apps via Direct Internet Access (DIA). In Cisco SD-WAN, DIA is configured in data policies. The action must be 'accept' to permit traffic. Since this is for general internet access involving potentially many internal users, 'nat overload' (PAT) is the standard and most efficient method, as opposed to 'nat pool' which requires pre-allocated addresses or 'use-vpn 0' which is syntactically incorrect or refers to a non-existent static mapping in this context. The 'tallback' keyword ensures that if the direct path fails, traffic can fall back to the IPsec tunnel (VPN) to reach the destination, meeting the 'unavailability' condition.
Why the Other Options Are Wrong
Option A uses 'nat pool', which is less common for simple DIA unless specific public IPs are reserved; 'overload' is the default best practice for client-side breakout. Option B and D use 'nat use-vpn 0', which is not a valid syntax for standard NAT configuration in SD-WAN data policies for DIA; it likely confuses the user with the 'vpn 0' management interface concept or is a distractor. Option D is identical to B, making both incorrect due to invalid syntax/semantics for the required functionality.
Community Comment Notes
Commenters note that there might be typos in the options provided in some dumps (e.g., 'tallback' vs 'fallback'), but the core logic remains: DIA requires NAT overload. One user pointed out 'Role of Talkback / Return Traffic', highlighting that tallback handles return traffic routing. Another user selected B, possibly due to confusion, but expert consensus and Cisco documentation favor 'nat overload' for typical DIA scenarios.
Exam Strategy
Always look for 'nat overload' when configuring DIA for general internet access unless specific IP pools are mentioned. Remember that 'tallback' is crucial for high availability in split-tunneling or DIA designs.
Frequently Asked Questions
Why use nat overload instead of nat pool?
What does nat tallback do in this context?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
westh4m1234 👍 1 Answered BThey have a typo (tallback) , Role of "Talkback" / Return Traffic
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All 300-415 Questions
Access 120 questions with complete answers and detailed explanations.
View Full 300-415 Practice Test →