Configure Direct Internet Access with NAT and Tallback
Refer to the exhibit.
An engineer must configure a policy on a SD-WAN Controller device. This policy will allow VPN99 at branch 1 for direct internet access when accessing Google Apps and using the routing table upon its unavailability. Which configuration must be applied to meet this requirement?
Community Insight
The key concept is enabling local breakout for a specific VPN while ensuring fallback to the WAN when the primary path fails, using 'nat overload' instead of static or pool-based NAT.
This question tests the configuration of direct internet access (DIA) on Cisco SD-WAN controllers using data policies, specifically focusing on NAT overload and tallback behavior for VPN99.
Learners often confuse 'nat use-vpn 0' with 'nat overload', not realizing that DIA requires dynamic port address translation (overload) for multiple internal hosts accessing the internet.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The requirement is to allow VPN99 at branch 1 to access Google Apps via Direct Internet Access (DIA). In Cisco SD-WAN, DIA is configured in data policies. The action must be 'accept' to permit traffic. Since this is for general internet access involving potentially many internal users, 'nat overload' (PAT) is the standard and most efficient method, as opposed to 'nat pool' which requires pre-allocated addresses or 'use-vpn 0' which is syntactically incorrect or refers to a non-existent static mapping in this context. The 'tallback' keyword ensures that if the direct path fails, traffic can fall back to the IPsec tunnel (VPN) to reach the destination, meeting the 'unavailability' condition.Why the Other Options Are Wrong
Option A uses 'nat pool', which is less common for simple DIA unless specific public IPs are reserved; 'overload' is the default best practice for client-side breakout. Option B and D use 'nat use-vpn 0', which is not a valid syntax for standard NAT configuration in SD-WAN data policies for DIA; it likely confuses the user with the 'vpn 0' management interface concept or is a distractor. Option D is identical to B, making both incorrect due to invalid syntax/semantics for the required functionality.Community Comment Notes
Commenters note that there might be typos in the options provided in some dumps (e.g., 'tallback' vs 'fallback'), but the core logic remains: DIA requires NAT overload. One user pointed out 'Role of Talkback / Return Traffic', highlighting that tallback handles return traffic routing. Another user selected B, possibly due to confusion, but expert consensus and Cisco documentation favor 'nat overload' for typical DIA scenarios.Official Reference
Exam Strategy
Always look for 'nat overload' when configuring DIA for general internet access unless specific IP pools are mentioned. Remember that 'tallback' is crucial for high availability in split-tunneling or DIA designs.
Frequently Asked Questions
Why use nat overload instead of nat pool?
Nat overload (PAT) is preferred for DIA because it allows many internal IPs to share a single public IP, saving address space compared to a fixed pool.
What does nat tallback do in this context?
It ensures that if the direct internet link fails, the traffic falls back through the IPsec tunnel (VPN) to maintain connectivity to the destination.
Related Analysis
Practice All 300-415 Questions
Access 120 questions with complete answers and detailed explanations.
View Full 300-415 Practice Test →