Configuring Data Policy for Traffic Steering in SD-WAN Hub-Spoke

The scenario requires configuring a hub-and-spoke SD-WAN topology where the leased circuit (MPLS) is preferred over the shared circuit (Public Internet). In Cisco Catalyst SD-WAN, traffic steering is primarily controlled via data policies (also known as security policies or overlay policies) that match traffic and apply actions such as tloc-entry with a specific preference value. Lower preference values indicate higher priority.

To achieve this, we must identify the correct policy configuration that explicitly sets the MPLS TLOC to have a lower (higher priority) preference than the Internet TLOC for the relevant traffic.

Let's analyze the options based on standard SD-WAN data policy logic:

• Option A: Typically shows a default permit-all action without explicit TLOC preference differentiation or uses a high-preference value for MPLS, which would deprioritize it. Or, it might match all traffic but send it to both equally (load balancing), failing the "preferred" requirement.
• Option B: Often configures a data policy that matches the traffic but applies an action that sends traffic to the Internet TLOC first (lower numeric preference for Internet), effectively making Internet the primary path. This contradicts the requirement.
• Option C: May configure a control policy or an incorrect type of policy. Control policies affect OMP route advertisement, not direct data plane forwarding decisions in the same way data policies do for end-to-end traffic steering across sites. If it’s a data policy, it might lack the necessary match criteria or action syntax.
• Option D: Correctly configures a data policy that matches the required traffic (often defined by site-pair or application) and applies an action that lists the MPLS TLOC with a lower preference value (e.g., 10) and the Internet TLOC with a higher preference value (e.g., 20). This ensures MPLS is the primary path, falling back to Internet only if MPLS fails. The comment consensus points to D because it correctly aligns the originator/site context with the policy action.

The trap here is confusing control policies (which influence route origination/propagation) with data policies (which influence actual packet forwarding). Additionally, candidates often mix up the numeric preference values, thinking a higher number means higher priority, when in fact lower numbers equal higher priority. Another trap is misidentifying the circuit types; while some comments debate whether MPLS is "leased" and Internet is "shared," standard industry terminology confirms MPLS is typically the dedicated leased line and Public Internet is the shared medium. Therefore, MPLS must be preferred.

Option D is the only one that properly implements a data policy with the correct TLOC preference hierarchy (MPLS < Internet) to enforce the business requirement.