Localizing OMP-to-OSPF route advertisement on a service VPN
Short answer
A Apply a localized control policy on VPN 10 matching the W2 OMP loopback as a /32 with action accept so it can reach the service-side OSPF neighbor.
Question
OSPF neighbor on the service-side VPN. Which configuration fulfills these requirements?
Key Takeaways
It tests whether you can separate default-action from match/action blocks in a localized control policy — set attributes are only valid inside the explicit match clause, and the loopback must be a /32 in a service VPN.
This 300-415 question tests a localized control policy that advertises an OMP-learned loopback into service-side OSPF; the correct configuration is option A, matching the /32 prefix in VPN 10 with an explicit action accept.
Common mistake: Option D is the tempting trap: its set attributes follow default-action (or misspell it as 'default action'), which the CLI does not accept, and even if legal, default-action would apply to every unmatched route rather than just the W2 loopback.
Expert Analysis
What kind of policy this is The scenario is a localized control policy on the WAN Edge router, not a centralized policy pushed from vSmart. The route already arrives over OMP; the customer now needs it to leave the Edge into service-side OSPF. Redistribution between OMP and a service-side routing protocol is governed on the router itself, under a route policy applied to the specific service VPN (VPN 10, valid in the 1–511 service range). That is the first boundary: control-plane routing on the Edge for one VPN, not data-plane traffic matching.
The match/action versus default-action boundary
The second, and most examined, boundary is inside the policy stanza. A default-action clause handles only routes that matched nothing, and it is a terminal accept/discard statement — it accepts no set attributes after it. Attributes such as metric-type, tag, or as-path changes must sit inside an explicit match … action accept block, where the set statements are structurally legal. As the discussion notes, one option places set after default-action, which is syntactically impossible, and another renders the keyword as default action (no hyphen), which the CLI rejects.
The prefix detail
A loopback is a host route: /32, not /24. Option A is correct because it targets VPN 10, matches the W2 loopback as a /32 from OMP, and applies action accept with the set attributes in the valid location so the prefix can be redistributed to the OSPF neighbor. Option D fails on set placement/syntax; B and C use the wrong VPN or prefix length.
Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
When a question shows route-policy snippets, first confirm the VPN number and prefix length, then verify structural syntax: anything after default-action must be a bare accept/discard. Eliminate every option whose set attributes sit in the default clause or whose loopback mask is not /32; the remaining syntactically valid, VPN-matched option is your answer.
Frequently Asked Questions
Why must the W2 loopback be matched as a /32 and not a /24?
Can I put set attributes after default-action in a localized control policy?
Is this a centralized policy from vSmart or a localized policy on the Edge?
Community Votes
60% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 14 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 14
-
Nalla123 👍 15Answer -A Question says --> W2 loopback received via OMP to the OSPF neighbor on the service-side VPN, so here service side VPNS come into 1-511. Option -A 1.) has mentioned with VPN 10 2.) Loopback set with /32 3.) After default action accept there wont be any set commands. In option A it says ACTION ACCEPT
-
TheNetworkStudent 👍 8key differences are the VPN number and that the loopback address is a /24 or /32. I think it should be VPN 10 and /32, which would make A correct.
-
RREVECO 👍 5The answer is A: EXPLANATION if we see the link: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/policies/vedge/policies-book/control-policies.html DETAIL 01 LOOPBACK = /32 and not /24 DETAIL 02 in answer D A) it says "default action" and not "default-action" = misspelled command B) even if it was good, the metric attributes are applied in the default option and not in the sequence 1 Detail 03: Question says: Which configuration fulfills these requirements? (ALTERNATIVE A is the most correct) if we see the link: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/policies/vedge/policies-book/control-policies.html the structure is: Structural Components for Localized Control Policy
-
Jimmy3848 👍 3Answer is A. ‘A’ has a ‘match & action accept’ pair, whereas answer ‘D’ has a ‘match’ without an ‘action accept,’ but rather the ‘default-action’ which makes the subsequent ‘set…’ action incorrect syntax.
-
Sky_Soul 👍 2Answer is A There is no possibility to SET something within the Default-Action configuration mode. Structural Components for Localized Control Policy policy lists as-path-list list-name as-path path-list community-list list-name community [aa:nn | internet | local-as | no-advertise | no-export] ext-community-list list-name community [rt (aa:nn | ip-address) | soo (aa:nn | ip-address)] prefix-list list-name ip-prefix prefix/length route-policy policy-name sequence number match match-parameters action reject accept set parameters default-action (accept | reject) vpn vpn-id router bgp local-as-number neighbor address address-family ipv4-unicast route-policy policy-name (in | out) vpn vpn-id router ospf route-policy policy-name in redistribute (bgp | connected | nat | omp | static) route-policy policy-name
Show 9 more comments
-
JTPRO 👍 2D is missing the "-" making it an invalid command. The correct syntax would be " default-action accept " . I think that makes answer A more correct because " action accept " is a valid command.
-
simo_2020 👍 2Answer must start with VPN 10(service side) & should have metric-type 1 and not with VPN 0 (transport side) so the answer is A
-
JasonNH 👍 2The Answer should be A?
-
NetArch_Teck 👍 1I concur with the network group. Loopback addresses are /32 normally when setting up peer to peer interfaces. VPN 0 is a transport WAN service , so option B and C are not correct VPN 10 - is within the range of service VPN's (besides 512 and 0 which are dedicated management and transport exclusive VPN services) Set commands are no longer accepted to the interface once the default-action command is imitated! Option A is the only answer that accommodates the request.
-
Crazy_Creator 👍 1Answer = D Do you see lack of word default in A answer ? The correct CLI syntax should be default action accept not accept action. They did it this way for the purpose hehe ... Another one tricky question, hard to find but once captured easy to see.
-
timtgh 👍 1I agree that it's A, for several reasons. But why the requirement for metric-type 1? The question doesn't seem to mention anything that would require using metric-type 1.
-
timtgh 👍 1Yes, and even if set commands were allowed in the default action, putting the set commands there would not limit them to that loopback as needed.
-
delulu10 👍 1A is the correct answer - VPN10 is service vpn, exact match and accept under metric 100.
-
sysarf 👍 1Answer A is correct
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All 300-415 Questions
Access 120 questions with complete answers and detailed explanations.
View Full 300-415 Practice Test →