Configuring Traffic Engineering for Admin VLAN in SD-WAN

300-415 By islever Editorial Last updated

Configure control policies

Short answer

B Configures policy to match Admin VLAN, sets higher TLOC preference for MPLS, and accepts traffic.

Question

An engineering team must prepare a traffic engineering policy where an MPLS circuit is preferred for traffic coming from the Admin VLAN. Internet should be used as a backup only. Which configuration fulfills this requirement?
  1. policy access-list TE-POLICY ipv4 access-list MGMT-VLAN permit ip any any service-policy type traffic-engineering TE-POLICY match ipv4 access-list MGMT-VLAN action accept tloc-list MPLS-PREFERRED tloc-list MPLS-PREFERRED tloc 10.1.1.1 internet preference 100 tloc 10.1.1.1 mpls preference 50
  2. policy access-list TE-POLICY ipv4 access-list ADMIN-VLAN permit ip any any service-policy type traffic-engineering TE-POLICY match ipv4 access-list ADMIN-VLAN action accept tloc-list MPLS-PREFERRED tloc-list MPLS-PREFERRED tloc 10.1.1.1 internet preference 50 tloc 10.1.1.1 mpls preference 100 Correct Answer
  3. policy access-list TE-POLICY ipv4 access-list MGMT-VLAN permit ip any any service-policy type traffic-engineering TE-POLICY match ipv4 access-list MGMT-VLAN action accept tloc-list MPLS-PREFERRED tloc-list MPLS-PREFERRED tloc 10.1.1.1 internet preference 100 tloc 10.1.1.1 mpls preference 200
  4. policy access-list TE-POLICY ipv4 access-list ADMIN-VLAN permit ip any any service-policy type traffic-engineering TE-POLICY match ipv4 access-list ADMIN-VLAN action reject tloc-list MPLS-PREFERRED tloc-list MPLS-PREFERRED tloc 10.1.1.1 internet preference 600 tloc 10.1.1.1 mpls preference 300

Key Takeaways

The core trap is confusing Management VLAN (512) with Admin VLAN, and misunderstanding that higher TLOC preference values indicate priority.

This question tests the configuration of control policies to prioritize MPLS over Internet for specific traffic. The correct setup uses a higher TLOC preference for MPLS and an accept action.

Common mistake: Candidates often select Option C because it targets VLAN 512, mistakenly assuming Admin VLAN is synonymous with the Management VPN.

Expert Analysis

Why the Answer Is Correct

Option B is the correct configuration because it matches traffic from the Admin VLAN (typically VLAN 10 or similar, distinct from management), sets a high TLOC preference (e.g., 100) for the MPLS path, and uses an 'accept' action. In Cisco SD-WAN, higher TLOC preference numbers are preferred, making this the primary path.

Why the Other Options Are Wrong

Options A and C incorrectly use VLAN 512, which is reserved for Management traffic (control plane communication with vManage/vSmart) and should not be used for data plane routing policies. Option D uses 'reject' as the action, which would drop traffic rather than route it, and may have incorrect preference settings.

Community Comment Notes

Many users, including wcorrea and Jonycici, confirmed that B is correct because it uses the proper VLAN and higher preference. ChrisCCNA noted that the exam version was clearer, emphasizing that MPLS must have lower priority (higher number). NetArch_Teck highlighted that Management VLAN 512 is not for WAN backhaul. Roger95’s comment claiming C is correct due to 'Admin Vlan = VPN 512' is a common misconception; they are distinct concepts in SD-WAN architecture.

Official Reference

https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/policies/ios-xe-17/policies-book-xe/policy-overview.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always distinguish between Management VLAN (512) and user/Admin VLANs. Remember that in TLOC preferences, higher numbers mean higher priority.

Frequently Asked Questions

Why is VLAN 512 incorrect for Admin VLAN traffic?

VLAN 512 is the default Management VLAN used for control plane communication with controllers, not for user data plane traffic like Admin VLAN.

Does higher TLOC preference mean better priority?

Yes, in Cisco SD-WAN, a higher TLOC preference value indicates a more preferred path compared to a lower value.

More 300-415 FAQ →

Discussion 16 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 16

  1. wcorrea 👍 23
    I think B is correct. Higher TLOC preference is chose. C is incorrect since this use VPN 512 (management) TLOC Preference. Prefer route with highest TLOC preference. https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2019/pdf/5eU6DfQV/TECRST-2191.pdf pag.42
  2. Jonycici 👍 4
    Correct answer is B. Higher TLOC preference is chosen, also VLAN should be 10 and not 512.
  3. ChrisCCNA 👍 3
    This question has been bugging me for days. I just passed the exam an hour ago and this question was on it. Here's the issue, the given answers here are incorrect I believe its a typo because on the exam the answer was obvious. So here's the correct details to look for: Mpls must have the lower priority. TLOC prefers lower. Action must equal accept in order to 'set' the tloc list Don't choose the one with NAT fallback or VPN 512 The default action is irrelevant Answer D I believe is the correct intended answer however I presume "action reject" is a typo. Action Accept is required.
  4. timtgh 👍 3
    B meets all the requirements, including action accept. D has action reject but also has wrong preference. Higher is better. Not sure why you said TLOC prefers lower. See Table 4 on this page: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/policies/ios-xe-17/policies-book-xe/policy-overview.html
  5. Jervv 👍 3
    who said to associate admin vlan to management vlan lol
Show 11 more comments
  1. NetArch_Teck 👍 2
    Option D fulfils the request! The configuration should not include the management VLAN 512. (This VLAN is designated to backhaul traffic via the controllers using DLTS/TLS traffic) The default action should be to accept Consequently this eliminates Options A and C to from the answer. Leaving B and D as options. The question requires that TLOC MPLS to be preferred and public internet as backup The preference with the lowest value is chosen within a tloc-list. To associate with the TLOC address. When you apply a TLOC list in an action accept condition, when multiple TLOCs are available and satisfy the match conditions, the TLOC with the lowest preference value is used. If two or more of TLOCs have the lowest preference value, traffic is sent among them in an ECMP fashion. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/command/sdwan-cr-book.pdf {Page 288}
  2. agkyawsoe 👍 2
    It's B.Admin Vlan is not Management and I think Management VPN (VPN512) doesn't pass on WAN link.
  3. Roger95 👍 2
    as ChrisCCNA's explanation, Admin Vlan = VPN 512. C is correct
  4. Aldebeer 👍 2
    I am quit agree with B!
  5. mohammad 👍 1
    For each TLOC, specify its address, color, and encapsulation. Optionally, set a preference value (from 0 to 232 – 1) to associate with the TLOC address. When you apply a TLOC list in an action accept condition, when multiple TLOCs are available and satisfy the match conditions, the TLOC with the highest preference value is used. If two or more of TLOCs have the highest preference value, traffic is sent among them in an ECMP fashion.
  6. westh4m1234 👍 1
    I go with D even though there is a mistake their "action reject" - TLOC Preference Rules • Higher is better: A TLOC with a greater preference number is chosen over one with a lower number. • Default value: Unconfigured TLOCs default to a preference value of 0. • ECMP behavior: If two or more TLOCs share the same highest preference value, traffic load-balances across them using Equal-Cost Multi-Path (ECMP)
  7. Rbrahmi 👍 1
    TLOC preference prefers the highest value. When a router has multiple available TLOCs (tunnel endpoints), it will choose the TLOC with the highest preference value to send traffic through. If multiple TLOCs share the same highest preference value, traffic is distributed equally among them using Equal-Cost Multi-Path (ECMP)
  8. ChrisCCNA 👍 1
    I think this is C. MPLS needs to have a higher preference so that eliminates A and D. Admin traffic hints at VPN 512. There's information about Traffic Engineering in the SDWAN configuration guide 18.4 page 301.
  9. ChrisCCNA 👍 1
    Disregard my comment. TLOC preference prefers the lowest value. You cannot include VPN 512 in a data policy. Only "action accept" packets are eligible to be modified by extra parameters.
  10. luctieuphung 👍 1
    Even though, you assume "action accept", but in TLOC list: MPLS preference is 300 and internet is 600, so internet is preferred. D is not corect.
  11. colipto 👍 1
    Answer A, due to the fallback requirement

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is Required for On-Premises vBond via PnP Connect?

S-grade

WAN Edge Registration with Enterprise CA Certificates

S-grade

Which Component Creates a Feature Profile in Cisco SD-WAN UX 2.0?

S-grade

Impacts of Losing vManage Connectivity to Cisco SD-WAN Fabric

S-grade

Practice All 300-415 Questions

Access 120 questions with complete answers and detailed explanations.

View Full 300-415 Practice Test →

← Back to 300-415 Study Guide