Dual-Transport SD-WAN Site: BFD on Both Transports

300-415 By islever Editorial Last updated

Configure TLOCs Describe WAN Edge deployment Troubleshoot control plane connectivity

Short answer

B The interface template that leaves restrict off so BFD forms on both the MPLS and Internet TLOCs, with max control connection set to 0 on MPLS so control traffic never tries to reach the AWS controllers.

Question

Company E wants to deploy Cisco SD-WAN with controllers in AWS. The company's existing WAN is on private MPLS without Internet access to controllers in
AWS. An Internet circuit is added to a site in addition to the existing MPLS circuit. Which interface template establishes BFD neighbors over both transports?
  1. [sampleXML/xmlfile-20_1.png]
  2. [sampleXML/xmlfile-21_1.png] Correct Answer
  3. [sampleXML/xmlfile-22_1.png]
  4. [sampleXML/xmlfile-23_1.png]

Key Takeaways

The question tests TLOC-level control — restrict must be off for BFD to form across colours, and max control connection must be 0 on the transport that cannot reach the AWS controllers.

For a site mixing private MPLS (no path to AWS controllers) with a new Internet circuit, option B is the interface template that forms BFD over both transports while keeping control connections off MPLS.

Common mistake: Choosing a template that enables restrict on the interfaces; this confines BFD/control to same-colour TLOCs, so no BFD neighbour forms across the MPLS and Internet transports.

Expert Analysis

The wording of the constraint drives the answer. The question asks which interface template "establishes BFD neighbors over both transports." That single qualifier demands that BFD sessions be able to form on the MPLS TLOC and on the newly added Internet TLOC. At the same time, the scenario states the MPLS circuit has "no Internet access to controllers in AWS," so any setting that lets control traffic try to reach the controllers over MPLS would break the deployment. Those two constraints must be satisfied together in one template.

Why option B satisfies both. Option B leaves restrict off on the transports, so BFD tracking is unrestricted and neighbours can form with TLOCs of any colour — both MPLS and Internet. It also sets the per-TLOC max control connection to 0 on the MPLS transport, which stops the MPLS tunnel from ever attempting control connections to the AWS-hosted managers, vSmarts and vBonds. Control therefore rides the Internet circuit while the data plane (BFD) still operates across both transports. This matches the reasoning recorded in the community note, which highlights exactly these two knobs.

Eliminating the other options. Options that enable restrict on an interface cap or filter the control and BFD sessions to matching colours, so the vEdge/cEdge would only form BFD with same-colour peers — that fails the "both transports" requirement and defeats the purpose of adding the Internet circuit. Templates that instead leave a non-zero control-connection allowance on MPLS attempt control plane reachability over a link that by definition cannot reach the AWS controllers, producing control-plane flapping and OMP instability. Neither pattern meets both qualifiers.

So the decisive template is the one that keeps restrict off (BFD on any colour) and pins control connections to 0 on MPLS — option B.

Official Reference

https://www.cisco.com/c/en/us/solutions/enterprise-networks/sd-wan/index.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Read the transport constraints first and translate each into a template keyword: 'no path to the controllers' becomes max control connection 0 on that transport, while 'BFD over both transports' means restrict must be off. Look for the single option that satisfies both keywords simultaneously — pairs that satisfy only one are the classic distractors in TLOC/interface-template questions.

Frequently Asked Questions

Why set max control connection to 0 on the MPLS transport?

It prevents the MPLS TLOC from attempting control connections to the AWS-hosted controllers, which it cannot reach, so control plane traffic uses the Internet circuit only and OMP stays stable.

What does the restrict keyword do on an SD-WAN interface?

With restrict enabled, the edge only establishes control and BFD sessions with TLOCs of the same colour. Leaving it off allows BFD neighbours with TLOCs of any colour, such as MPLS and Internet at one site.

Can BFD run over a transport that carries no control traffic?

Yes. BFD is a data-plane mechanism between TLOCs; control-plane reachability to the controllers is controlled separately by per-TLOC control connection settings.

More 300-415 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. delulu10 👍 1
    B is correct - Restrict is off, BFD can form to tlocs of any color. Max control is 0, so the MPLS tunnel never tries to reach the controllers AWS.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is Required for On-Premises vBond via PnP Connect?

S-grade

WAN Edge Registration with Enterprise CA Certificates

S-grade

Which Component Creates a Feature Profile in Cisco SD-WAN UX 2.0?

S-grade

Impacts of Losing vManage Connectivity to Cisco SD-WAN Fabric

S-grade

Practice All 300-415 Questions

Access 120 questions with complete answers and detailed explanations.

View Full 300-415 Practice Test →

← Back to 300-415 Study Guide