Configuring Traffic Engineering for Admin VLAN in SD-WAN
Configure control policies
An engineering team must prepare a traffic engineering policy where an MPLS circuit is preferred for traffic coming from the Admin VLAN. Internet should be used as a backup only. Which configuration fulfills this requirement?
Answer
Correct answer: B — Configures policy to match Admin VLAN, sets higher TLOC preference for MPLS, and accepts traffic.
Community Insight
The core trap is confusing Management VLAN (512) with Admin VLAN, and misunderstanding that higher TLOC preference values indicate priority.
This question tests the configuration of control policies to prioritize MPLS over Internet for specific traffic. The correct setup uses a higher TLOC preference for MPLS and an accept action.
Candidates often select Option C because it targets VLAN 512, mistakenly assuming Admin VLAN is synonymous with the Management VPN.
Community Discussion (16 comments)
westh4m1234
👍 1
I go with D even though there is a mistake their "action reject" - TLOC Preference Rules • Higher is better: A TLOC with a greater preference number is chosen over one with a lower number. • Default value: Unconfigured TLOCs default to a preference value of 0. • ECMP behavior: If two or more TLOCs share the same highest preference value, traffic load-balances across them using Equal-Cost Multi-Path (ECMP)
Aldebeer
👍 2
I am quit agree with B!
NetArch_Teck
👍 2
Option D fulfils the request! The configuration should not include the management VLAN 512. (This VLAN is designated to backhaul traffic via the controllers using DLTS/TLS traffic) The default action should be to accept Consequently this eliminates Options A and C to from the answer. Leaving B and D as options. The question requires that TLOC MPLS to be preferred and public internet as backup The preference with the lowest value is chosen within a tloc-list. To associate with the TLOC address. When you apply a TLOC list in an action accept condition, when multiple TLOCs are available and satisfy the match conditions, the TLOC with the lowest preference value is used. If two or more of TLOCs have the lowest preference value, traffic is sent among them in an ECMP fashion. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/command/sdwan-cr-book.pdf {Page 288}
mohammad
👍 1
For each TLOC, specify its address, color, and encapsulation. Optionally, set a preference value (from 0 to 232 – 1) to associate with the TLOC address. When you apply a TLOC list in an action accept condition, when multiple TLOCs are available and satisfy the match conditions, the TLOC with the highest preference value is used. If two or more of TLOCs have the highest preference value, traffic is sent among them in an ECMP fashion.
colipto
👍 1
Answer A, due to the fallback requirement
agkyawsoe
👍 2
It's B.Admin Vlan is not Management and I think Management VPN (VPN512) doesn't pass on WAN link.
Jonycici
👍 4
Correct answer is B. Higher TLOC preference is chosen, also VLAN should be 10 and not 512.
Roger95
👍 2
as ChrisCCNA's explanation, Admin Vlan = VPN 512. C is correct
Jervv
👍 3
who said to associate admin vlan to management vlan lol
wcorrea
👍 23
I think B is correct. Higher TLOC preference is chose. C is incorrect since this use VPN 512 (management) TLOC Preference. Prefer route with highest TLOC preference. https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2019/pdf/5eU6DfQV/TECRST-2191.pdf pag.42
ChrisCCNA
👍 3
This question has been bugging me for days. I just passed the exam an hour ago and this question was on it. Here's the issue, the given answers here are incorrect I believe its a typo because on the exam the answer was obvious. So here's the correct details to look for: Mpls must have the lower priority. TLOC prefers lower. Action must equal accept in order to 'set' the tloc list Don't choose the one with NAT fallback or VPN 512 The default action is irrelevant Answer D I believe is the correct intended answer however I presume "action reject" is a typo. Action Accept is required.
timtgh
👍 3
B meets all the requirements, including action accept. D has action reject but also has wrong preference. Higher is better. Not sure why you said TLOC prefers lower. See Table 4 on this page: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/policies/ios-xe-17/policies-book-xe/policy-overview.html
luctieuphung
👍 1
Even though, you assume "action accept", but in TLOC list: MPLS preference is 300 and internet is 600, so internet is preferred. D is not corect.
Rbrahmi
👍 1
TLOC preference prefers the highest value. When a router has multiple available TLOCs (tunnel endpoints), it will choose the TLOC with the highest preference value to send traffic through. If multiple TLOCs share the same highest preference value, traffic is distributed equally among them using Equal-Cost Multi-Path (ECMP)
ChrisCCNA
👍 1
I think this is C. MPLS needs to have a higher preference so that eliminates A and D. Admin traffic hints at VPN 512. There's information about Traffic Engineering in the SDWAN configuration guide 18.4 page 301.
ChrisCCNA
👍 1
Disregard my comment. TLOC preference prefers the lowest value. You cannot include VPN 512 in a data policy. Only "action accept" packets are eligible to be modified by extra parameters.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is the correct configuration because it matches traffic from the Admin VLAN (typically VLAN 10 or similar, distinct from management), sets a high TLOC preference (e.g., 100) for the MPLS path, and uses an 'accept' action. In Cisco SD-WAN, higher TLOC preference numbers are preferred, making this the primary path.Why the Other Options Are Wrong
Options A and C incorrectly use VLAN 512, which is reserved for Management traffic (control plane communication with vManage/vSmart) and should not be used for data plane routing policies. Option D uses 'reject' as the action, which would drop traffic rather than route it, and may have incorrect preference settings.Community Comment Notes
Many users, including wcorrea and Jonycici, confirmed that B is correct because it uses the proper VLAN and higher preference. ChrisCCNA noted that the exam version was clearer, emphasizing that MPLS must have lower priority (higher number). NetArch_Teck highlighted that Management VLAN 512 is not for WAN backhaul. Roger95’s comment claiming C is correct due to 'Admin Vlan = VPN 512' is a common misconception; they are distinct concepts in SD-WAN architecture.Official Reference
Exam Strategy
Always distinguish between Management VLAN (512) and user/Admin VLANs. Remember that in TLOC preferences, higher numbers mean higher priority.
Frequently Asked Questions
Why is VLAN 512 incorrect for Admin VLAN traffic?
VLAN 512 is the default Management VLAN used for control plane communication with controllers, not for user data plane traffic like Admin VLAN.
Does higher TLOC preference mean better priority?
Yes, in Cisco SD-WAN, a higher TLOC preference value indicates a more preferred path compared to a lower value.
Related Analysis
Practice All 300-415 Questions
Access 120 questions with complete answers and detailed explanations.
View Full 300-415 Practice Test →