Configuring Same-Color IPsec Tunnels with Restrict Keyword
Short answer
B Configuring the TLOC with the 'public-internet' color and the 'restrict' keyword ensures IPsec tunnels are established exclusively between WAN Edge devices sharing the same color.
Question
is to have IPsec VPN tunnels established between the same colors. Which configuration meets the requirement on both WAN Edge devices?
Key Takeaways
The trap is ignoring the 'restrict' keyword; without it, IPsec tunnels can form between different colors on the same underlay, violating the 'same color' requirement.
This question tests the configuration of TLOCs in Cisco SD-WAN to enforce same-color IPsec tunneling. The correct solution involves using the 'restrict' keyword with a consistent public color like 'public-internet'.
Common mistake: Choosing an option without the 'restrict' keyword or using mismatched colors. Students may think any valid color works, but 'restrict' is mandatory to prevent cross-color tunnel establishment.
Expert Analysis
The core requirement is to establish IPsec VPN tunnels between WAN Edge devices using the same color on an Internet transport. In Cisco Catalyst SD-WAN, TLOCs (Transport Locators) are identified by a combination of IP address, transport type (underlay), and color. By default, TLOCs can form tunnels with other TLOCs regardless of color if they share the same underlay type, but restricting this behavior ensures strict adherence to specific routing policies.
To enforce that tunnels are established only between matching colors, the restrict keyword must be applied to the TLOC configuration. Without restrict, a TLOC with color 'gold' could still form a tunnel with a TLOC with color 'public-internet' if both use the IPsec underlay, which violates the spirit of strict color-based segmentation often required in enterprise designs.
Analyzing the options based on standard public color names:
- Option B configures the TLOC with the color
public-internetand includes therestrictkeyword. This explicitly tells the device to only form IPsec tunnels with peers that also have thepublic-internetcolor. Since both branches need to connect via Internet, using a consistent public color likepublic-internetis the correct design pattern. - Option C likely uses a different color or lacks the
restrictkeyword, or uses a non-standard color name. If it lacksrestrict, it allows cross-color tunnels. If it uses a different color than the peer, no tunnel forms. - Options A and D typically represent configurations where either the
restrictkeyword is missing or the colors are mismatched/defaulted without enforcement.
The comment section highlights that restrict is the critical mechanism for enforcing same-color tunneling. The consensus points to B as the best answer because it combines the appropriate public color (public-internet) for internet transit with the restrict command to ensure tunneling occurs only between matching colors. Therefore, the configuration must include color public-internet restrict on both devices.
Exam Strategy
When configuring TLOCs for strict segmentations, always check for the restrict keyword. If the requirement specifies tunnels only between identical attributes (like color), restrict is necessary to block automatic peering with differing attributes. Memorize standard public colors such as public-internet, mpls, lte, and private to quickly identify valid configurations.
Frequently Asked Questions
Why is the 'restrict' keyword necessary for same-color tunnels?
What are the standard public colors in Cisco SD-WAN?
Community Votes
60% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 14 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 14
-
NetArch_Teck 👍 3However this is a spurious question the Restrict keyword with the COLOR option prevents attempts to establish BFD sessions to TLOCs with different colors. i.e., if 'color mpls restrict' is configured, the TLOC will establish BFD sessions only with MPLS TLOC color nodes. The public colors are:- 3g, biz-internet, blue, bronze, custom1, custom2, custom3, default, gold, green, lte, public-internet, red, and silver. So technically Options A,B and C are valid and satisfies the question in hand! If I were to use logical traditional Cisco naming conventions and consistency. I believe the answer to be B
-
Erik_N 👍 3B is the better answer with reference color to internet. C will work too
-
assili 👍 2answear bad copied : wan edge 1 ; ; color public-internet restrict ; wan edge 2 ; ; color gold restrict ;;
-
Alchobashko 👍 2"two branch WAN Edge devices where an Internet connection is available". Should be B.
-
RafaJohnston76 👍 1on the other hand, the question says "The requirement is to have IPsec VPN tunnels established between the same colors", without a "restrict" they will still established TLOCs with the same color, as well as with different ones, but it would meet the requirement any thoughts?
Show 9 more comments
-
BrentL 👍 1The way the question appears here it could be B or C and while B is the better choice since has internet label, it's using private addressing which could indicate C is correct choice unless there is a typo as assili was possibly implying.
-
westh4m1234 👍 1B & C there is no difference both will do the trick however i think B is better"public internet" as the color with restrict. even A will do the trick with defaulted colors
-
D3n1s 👍 1the keyword is "restrict", B and C are valid. Gold and public-internet are public color :)
-
mikidvd51 👍 1You are right highly likely. Otherwise these answer options are bad joke.
-
elninio13 👍 1But also A meets the requirement as long as there is one connection...
-
MerlinTheWizard 👍 1The naming of colors is not important as long as they are consistent
-
LLMenterprise 👍 1answer is B , must establish with same color using restrict
-
Jonycici 👍 1why C and not B?
-
mikidvd51 👍 1good point:-)
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All 300-415 Questions
Access 120 questions with complete answers and detailed explanations.
View Full 300-415 Practice Test →